Closed Bug 517637 Opened 13 years ago Closed 13 years ago

TM: "Assertion failure: sprop->methodValue() == prev"


(Core :: JavaScript Engine, defect, P1)






(Reporter: jruderman, Assigned: brendan)



(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)


(1 file, 1 obsolete file)

js> for (var j = 0; j < 7; ++j) uneval({x: function () {}})
Assertion failure: sprop->methodValue() == prev, at ../jsscope.cpp:1583

js> for (var j = 0; j < 7; ++j) ({x: function () {}}).x 
Assertion failure: sprop->methodValue() == *vp, at ../jsscope.h:676

Doesn't crash opt.  Requires -j.  TM rev 32d61518f755+.
I get this on jsfunfuzz too.

autoBisect shows this is probably related to bug 471214:

The first bad revision is:
changeset:   32130:842e6c09e35a
user:        Brendan Eich
date:        Thu Sep 03 14:41:19 2009 -0700
summary:     Join lambdas assigned or initialized as methods to the compiler-created function object if we can, with a read barrier to clone on method value extractions other than call expressions (471214, r=jorendorff).
Blocks: 471214
Flags: blocking1.9.2?
Keywords: regression
Attached patch fix (obsolete) — Splinter Review
Urgh, the patch for bug 471214 was not complete. Glad Gary's fuzzing found this. Wonder how rare it is on the web.

Assignee: general → brendan
Attachment #401911 - Flags: review?(jorendorff)
Comment on attachment 401911 [details] [diff] [review]

Yep, I don't know how I managed to overlook this.

The patch is missing trace-tests. r=me with that fixed.
Attachment #401911 - Flags: review?(jorendorff) → review+
Attached patch fix, v2Splinter Review
Wasn't caffeinated enough earlier, trace-tests ftw. Thanks,

Attachment #401911 - Attachment is obsolete: true
Attachment #401954 - Flags: review?(jorendorff)
Attachment #401954 - Flags: review?(jorendorff) → review+

OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla1.9.2
Duplicate of this bug: 518830
This patch needs to get onto m-c and 1.9.2 ASAP. The other regressions blocking bug 471214 could be dups of this one.

Er, I see this on m-c. Finding the hg shortlog entry for the landing...

Still needed on 1.9.2 according to bug request flags.

Closed: 13 years ago
Resolution: --- → FIXED
Sorry, lame bug reading on my part. This is fixed on m-c, though, so should be resolved. The other regressions from bug 471214 must be distinct problems.

Sayrer, can you confirm?

(In reply to comment #9)
> Sorry, lame bug reading on my part. This is fixed on m-c, though, so should be
> resolved. The other regressions from bug 471214 must be distinct problems.

I didn't land 471214 on 1.9.2 because of its regressions. This bug is fixed on m-c. I must have missed it when I was setting things FIXED.
Duplicate of this bug: 518279
Flags: in-testsuite+
v 1.9.3
Need a blocking decision here for mozilla-1.9.2.
Flags: blocking1.9.2? → blocking1.9.2-
Bug 524826 fixed some obvious non-parallel logic in jstracer.cpp added here.

Depends on: 524826
You need to log in before you can comment on or make changes to this bug.