582899 - JM: "Assertion failure: tempObj->isNative(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    (function () {
        __proto__ = [];
        for each(y in [0, 0]) {
            this.__defineGetter__("", function () {})
        }
    })()
} catch (e) {}

asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: tempObj->isNative(), at ../methodjit/PolyIC.cpp:827

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

I'll check this one out.

Comment 2

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Bail if a native is seen when compiling getprop stub.

Ah, this is that thing I hadn't gotten around to follow-up for. If we see a native along the proto chain the shape is invalid. Was correct in the GetElem compiler but not the GetProp compiler. Putting a refactoring on my TODO list.

Comment 3

[Brendan Eich [:brendan]]

A *non*-native, you mean (comment needs fixing).

/be

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 461215 [details] [diff] [review]
Bail if a native is seen when compiling getprop stub.

>diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
>--- a/js/src/methodjit/PolyIC.cpp
>+++ b/js/src/methodjit/PolyIC.cpp
>@@ -819,17 +819,23 @@ class GetPropCompiler : public PICStubCo
>             Address proto(pic.objReg, offsetof(JSObject, proto));
>             do {
>                 tempObj = tempObj->getProto();
>                 // FIXME: we should find out why this condition occurs. It is probably
>                 // related to PICs on globals.
>                 if (!tempObj)
>                     return false;
>                 JS_ASSERT(tempObj);
>-                JS_ASSERT(tempObj->isNative());
>+
>+                /* 
>+                 * If there is a native along the prototype chain the shape is technically
>+                 * invalid.
>+                 */
>+                if (!tempObj->isNative())
>+                    return false;
> 

false will propagate a failure. You want something like, return disable("non-native prototype")

r=me with that fixed

(extra credit: fix wrong return value on that tempObj check above)

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/ec75a84008e0

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/pic/bug582899.js.