486578 - TM: "Assertion failure: scope->object == pobj" with function, __proto__, length

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

var o = function(){};
  o.__proto__ = [];
  for (var j = 0; j < 3; ++j)
    o.length;

Assertion failure: scope->object == pobj, at ../jsinterp.cpp:144

Tested on mozilla-central.

Comment 1

[Jesse Ruderman]

Happens on tracemonkey branch too.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 469347 or http://hg.mozilla.org/tracemonkey/rev/b3b8454e003d :

The first bad revision is:
changeset:   26156:b3b8454e003d
user:        Jeff Walden
date:        Tue Mar 17 20:19:57 2009 -0700
summary:     Bug 469347 - TM: obj.length and slowArray.length don't trace.  r=gal

Comment 3

[Jeff Walden [:Waldo]]

Attachment: Abort if the property's found on a non-native object, dropping property in process

This seems to be the most minimal fix for the problem; we can handle numeric properties of arrays on the prototype chain, so not entirely sure why length would be different, but clearly it is, and it's not worth optimizing apparently-specifically for that case.

Comment 4

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/3030cb328d59

Still looking for a rightful blocking+...

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3030cb328d59

Comment 6

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/a65c38f42b4b

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the
following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre)
Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043

Comment 8

[Bob Clary [:bc] (inactive)]

js1_8_1/trace/trace-test.js
http://hg.mozilla.org/tracemonkey/rev/61892f57b46a

Comment 9

[Bob Clary [:bc] (inactive)]

cvsroot/mozilla/js/tests/js1_8_1/trace/trace-test.js,v  <--  trace-test.js
new revision: 1.14; previous revision: 1.13

/cvsroot/mozilla/js/tests/shell.js,v  <--  shell.js