1237998 - Assertion failure: [infer failure] Missing type in object [0x129586640] marker: [0x129586850], at /builds/slave/m-cen-m64-d-000000000000000000/build/src/js/src/vm/TypeInference.cpp:305

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter crash stack

found via bughunter 

Assertion failure: [infer failure] Missing type in object [0x129586640] marker: [0x129586850], at /builds/slave/m-cen-m64-d-000000000000000000/build/src/js/src/vm/TypeInference.cpp:305

Steps to reproduce:
Load http://mojtermin.mk/map

Comment 1

[Carsten Book [:Tomcat]]

jan, i think this is for you

Comment 2

[Jan de Mooij [:jandem]]

TI bugs are usually s-s.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

Regression from bug 1236546.

Before that bug, objects with a null proto had unknown properties. Unboxed object expandos relied on this: the AddSlot ICs guard on the unboxed group and the expando shape, but not on the expando's group. This patch gives expando objects unknown properties to fix this.

I was unable to write a shell testcase for this, but I verified it fixes the TI failure.

Comment 4

[Brian Hackett [Laid off!]]

Comment on attachment 8706029 [details] [diff] [review]
Patch

Review of attachment 8706029 [details] [diff] [review]:
-----------------------------------------------------------------

This is a bogus assert, right?  Since expandos aren't directly accessible by scripts, the type information for their properties is reflected in the type information of the unboxed group they are storing properties for.

Comment 5

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9ee3fb4a1528

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9ee3fb4a1528