1318634 - Assertion failure: *isOwnProperty == (receivers.empty() && convertUnboxedGroups.empty()), at js/src/jit/BaselineInspector.cpp:897

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 28e2a6dde76a (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

+/y/;
+/y/;
uneval(/x/.__proto__);
/x/.__proto__.__proto__ = function() {};
/x/.__proto__.__proto__[/z/];


Backtrace:

0   js-dbg-64-dm-clang-darwin-28e2a6dde76a	0x0000000103fb44ca js::jit::BaselineInspector::commonGetPropFunction(unsigned char*, JSObject**, js::Shape**, JSFunction**, js::Shape**, bool*, mozilla::Vector<js::ReceiverGuard, 4ul, js::jit::JitAllocPolicy>&, mozilla::Vector<js::ObjectGroup*, 4ul, js::jit::JitAllocPolicy>&) + 1882 (BaselineInspector.cpp:897)
1   js-dbg-64-dm-clang-darwin-28e2a6dde76a	0x000000010366c069 js::jit::IonBuilder::getPropTryCommonGetter(bool*, js::jit::MDefinition*, js::PropertyName*, js::TemporaryTypeSet*) + 265 (IonBuilder.cpp:12174)
2   js-dbg-64-dm-clang-darwin-28e2a6dde76a	0x0000000103651d8d js::jit::IonBuilder::jsop_getprop(js::PropertyName*) + 1517 (IonBuilder.cpp:11555)
3   js-dbg-64-dm-clang-darwin-28e2a6dde76a	0x0000000103642888 js::jit::IonBuilder::inspectOpcode(JSOp) + 648 (IonBuilder.cpp:2065)
4   js-dbg-64-dm-clang-darwin-28e2a6dde76a	0x000000010363e4a2 js::jit::IonBuilder::traverseBytecode() + 674 (IonBuilder.cpp:1547)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/3656a6f2cd7e
user:        Jan de Mooij
date:        Tue Nov 15 15:54:14 2016 +0100
summary:     Bug 1310125 part 2 - Port Baseline scripted getter IC stub to CacheIR. r=h4writer

Jan, is bug 1310125 a likely regressor?

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

Small bug, we need to add the receiver after doing the other checks.

I also wrote a less obscure test for this and added some correctness checks.

Comment 4

[Hannes Verschore [:h4writer]]

Comment on attachment 8812170 [details] [diff] [review]
Patch

Review of attachment 8812170 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/528b50a82eab
Fix AddCacheIRGetPropFunction to add the receiver after doing other checks. r=h4writer

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/528b50a82eab