532363 - TM: "Assertion failure: IsDenseArrayId(cx, obj, (jsid) prop), at ../jsarray.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  for each(z in [0, 0, 0, 0]) { ({
      __parent__: []
    } = [])
  }
})()


asserts js debug shell on TM tip with -j at Assertion failure: IsDenseArrayId(cx, obj, (jsid) prop), at ../jsarray.cpp:745

autoBisect shows this is probably related to bug 507683:

The first bad revision is:
changeset:   31824:8ca247a7d4ba
user:        Jason Orendorff
date:        Tue Aug 25 15:02:58 2009 -0700
summary:     Bug 507683 part 2 - Avoid lookup on trace when calling a native getter with no slot. r=gal.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nominating for 1.9.2 since the potentially related bug has landed on 1.9.2, deferring to others about whether this issue should be blocking or not.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

blah

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 415946 [details] [diff] [review]
v1

r=bzbarsky

Comment 4

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/f35155bb7064

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/f35155bb7064

Comment 6

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/88d9224dda3c

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929