495844 - TM: "Assertion failure: OBJ_IS_NATIVE(obj), at ../jstracer.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (var x = 0; x < 1; +x) { [4].sort-- }

asserts TM dbg js shell with -j at Assertion failure: OBJ_IS_NATIVE(obj), at ../jstracer.cpp:8949

Comment 1

[Andreas Gal :gal]

No biggie. We can fix this.

(gdb) bt
#0  JS_Assert (s=0x1af500 "OBJ_IS_NATIVE(obj)", file=0x1bd939 "../jstracer.cpp", ln=8949) at ../jsutil.cpp:69
#1  0x00159486 in TraceRecorder::prop (this=0x30dd00, obj=0x2bc120, obj_ins=0x278184, slot=@0xbfffed14, v_ins=@0xbfffed10) at ../jstracer.cpp:8949
#2  0x00159e34 in TraceRecorder::incProp (this=0x30dd00, incr=-1, pre=false) at ../jstracer.cpp:5853
#3  0x00159fbf in TraceRecorder::record_JSOP_PROPDEC (this=0x30dd00) at ../jstracer.cpp:7974
#4  0x0015ed18 in TraceRecorder::monitorRecording (cx=0x30bc70, tr=0x30dd00, op=JSOP_PROPDEC) at jsopcode.tbl:171
#5  0x0006d9d4 in js_Interpret (cx=0x30bc70) at ../jsinterp.cpp:3038
#6  0x0009a6b5 in js_Execute (cx=0x30bc70, chain=0x2bc000, script=0x30d9d0, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1622
#7  0x000108f8 in JS_ExecuteScript (cx=0x30bc70, obj=0x2bc000, script=0x30d9d0, rval=0x0) at ../jsapi.cpp:5046
#8  0x00009dd0 in Process (cx=0x30bc70, obj=0x2bc000, filename=0xbffff984 "x3.js", forceTTY=0) at ../../shell/js.cpp:412
#9  0x0000aae6 in ProcessArgs (cx=0x30bc70, obj=0x2bc000, argv=0xbffff884, argc=2) at ../../shell/js.cpp:806
#10 0x0000aeb3 in main (argc=2, argv=0xbffff884, envp=0xbffff890) at ../../shell/js.cpp:4729

Comment 2

[Andreas Gal :gal]

(gdb) call js_DumpObject(obj)
object 0x2bc120
class 0x1cb460 Array
elements
   0: 4

Comment 3

[Andreas Gal :gal]

Attachment: patch

For fast arrays we find named properties along the prototype (Array), so trying to do OBJ_SCOPE(obj) is wrong since obj is not native. obj2 is what we want.

Comment 4

[Andreas Gal :gal]

Very good test case. ++Gary.

Comment 5

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/51957ad5a714

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This is a regression with the following regression window:

Does not assert: 28222 - http://hg.mozilla.org/tracemonkey/rev/9eace9771241

Asserts: 28356 - http://hg.mozilla.org/tracemonkey/rev/d62fa90d2035

I'm unable to narrow down using autoBisect because debug shell builds were apparently broken in some intermediate revisions.

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/51957ad5a714

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/50085f9b548e

Comment 9

[Serge Gautherie (:sgautherie)]

Where else do you want this to land?

Comment 10

[Bob Clary [:bc] (inactive)]

testArrayNamedProp in trace-test.js
v 1.9.3, 1.9.2