517637 - TM: "Assertion failure: sprop->methodValue() == prev"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> for (var j = 0; j < 7; ++j) uneval({x: function () {}})
Assertion failure: sprop->methodValue() == prev, at ../jsscope.cpp:1583

js> for (var j = 0; j < 7; ++j) ({x: function () {}}).x 
Assertion failure: sprop->methodValue() == *vp, at ../jsscope.h:676

Doesn't crash opt.  Requires -j.  TM rev 32d61518f755+.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I get this on jsfunfuzz too.

autoBisect shows this is probably related to bug 471214:

The first bad revision is:
changeset:   32130:842e6c09e35a
user:        Brendan Eich
date:        Thu Sep 03 14:41:19 2009 -0700
summary:     Join lambdas assigned or initialized as methods to the compiler-created function object if we can, with a read barrier to clone on method value extractions other than call expressions (471214, r=jorendorff).

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Urgh, the patch for bug 471214 was not complete. Glad Gary's fuzzing found this. Wonder how rare it is on the web.

/be

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 401911 [details] [diff] [review]
fix

Yep, I don't know how I managed to overlook this.

The patch is missing trace-tests. r=me with that fixed.

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix, v2

Wasn't caffeinated enough earlier, trace-tests ftw. Thanks,

/be

Comment 5

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/27a40bf30ef3

/be

Comment 7

[Brendan Eich [:brendan]]

This patch needs to get onto m-c and 1.9.2 ASAP. The other regressions blocking bug 471214 could be dups of this one.

/be

Comment 8

[Brendan Eich [:brendan]]

Er, I see this on m-c. Finding the hg shortlog entry for the landing...

http://hg.mozilla.org/mozilla-central/rev/27a40bf30ef3

Still needed on 1.9.2 according to bug request flags.

/be

Comment 9

[Brendan Eich [:brendan]]

Sorry, lame bug reading on my part. This is fixed on m-c, though, so should be resolved. The other regressions from bug 471214 must be distinct problems.

Sayrer, can you confirm?

/be

Comment 10

[Robert Sayre]

(In reply to comment #9)
> Sorry, lame bug reading on my part. This is fixed on m-c, though, so should be
> resolved. The other regressions from bug 471214 must be distinct problems.

I didn't land 471214 on 1.9.2 because of its regressions. This bug is fixed on m-c. I must have missed it when I was setting things FIXED.

Comment 12

[Bob Clary [:bc] (inactive)]

js/src/trace-test/tests/basic/testMethodInitDeref.js
js/src/trace-test/tests/basic/testMethodInitUneval.js

Comment 13

[Bob Clary [:bc] (inactive)]

v 1.9.3

Comment 14

[Mike Beltzner [:beltzner, not reading bugmail]]

Need a blocking decision here for mozilla-1.9.2.

Comment 15

[Brendan Eich [:brendan]]

Bug 524826 fixed some obvious non-parallel logic in jstracer.cpp added here.

/be