507080 - TM: "Assertion failure: !(sprop->attrs & JSPROP_GETTER), at ../jstracer.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x getter = function (){}
for (z = 0; z < 2; ++z) {
    if (z) {
        x = 0
    }
}

asserts js dbg shell on TM branch with -j at Assertion failure: !(sprop->attrs & JSPROP_GETTER), at ../jstracer.cpp:9445

Comment 1

[Jeff Walden [:Waldo]]

Give you one guess what/whose this is, just based on it being getter/setter-related...

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect tries a cheeky guess at bug 503408 :

The first bad revision is:
changeset:   30696:0184d3d87db9
user:        Jason Orendorff
date:        Mon Jul 27 16:47:34 2009 -0500
summary:     Bug 503408 - Trace native setters. r=brendan.

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v1 - weaken assertion to record-time check

Oops. Those cases are errors, but they fill the property cache anyway-- the interpreter hasn't noticed the error yet.

Comment 4

[Andreas Gal :gal]

Comment on attachment 391612 [details] [diff] [review]
v1 - weaken assertion to record-time check

could probably be combined to sprop->attrs & (JSPROP_GETTER|SETTER|READONLY) but its up to you. This way the message is more precise, but also misleading (a read-only getter aborts saying its because its a getter, but it would abort because of read-only too)

Comment 5

[Jason Orendorff [:jorendorff]]

(In reply to comment #4)
> (From update of attachment 391612 [details] [diff] [review])
> could probably be combined to sprop->attrs & (JSPROP_GETTER|SETTER|READONLY)
> but its up to you. This way the message is more precise, but also misleading (a
> read-only getter aborts saying its because its a getter, but it would abort
> because of read-only too)

Good point, I didn't consider it. But I'll leave it this way. It won't help users much, but I like seeing all the cases in the code. Executable comments.

Comment 6

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/1105f304ea8b

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/1105f304ea8b

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)

Comment 9

[Tracy Walker [:tracy]]

verified with: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.2a2pre) Gecko/20090911 Namoroka/3.6a2pre

Comment 10

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.