1871880 - Assertion failure: obj->nonCCWRealm()->realmFuses.optimizeGetIteratorFuse.intact(), at jit/CacheIR.cpp:13563

Status: RESOLVED DUPLICATE of bug 1871597

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Array.prototype[Symbol.iterator] = Array.prototype[Symbol.iterator];
[] = [];

Assertion failure: obj->nonCCWRealm()->realmFuses.optimizeGetIteratorFuse.intact(), at /home/yksnegowt/trees/mozilla-central/js/src/jit/CacheIR.cpp:13563
#01: ???[/home/yksnegowt/shell-cache/js-dbg-64-linux-x86_64-5c45743d053b/js-dbg-64-linux-x86_64-5c45743d053b +0x2ac8bd7]
#02: ???[/home/yksnegowt/shell-cache/js-dbg-64-linux-x86_64-5c45743d053b/js-dbg-64-linux-x86_64-5c45743d053b +0x2ac876e]
#03: ???[/home/yksnegowt/shell-cache/js-dbg-64-linux-x86_64-5c45743d053b/js-dbg-64-linux-x86_64-5c45743d053b +0x2889632]
#04: ??? (???:???)
Segmentation fault

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/74ac8b5c353a
user:        Matthew Gaudet
date:        Wed Dec 20 16:31:45 2023 +0000
summary:     Bug 1870725 - Assert fuse isn't popped in CacheIR r=iain

Run with --fuzzing-safe --no-threads --blinterp-eager --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --with-ccache --enable-nspr-build --enable-ctypes --enable-debug-symbols --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 5c45743d053b.

Matthew, is bug 1870725 a likely regressor? Setting s-s just in case.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1870725

Comment 2

[Iain Ireland [:iain]]

This looks like the same issue as bug 1871597. It is not security-sensitive, because we're still just asserting that we have the fuse implementation right, and aren't depending on fuses for anything yet.