592226 - "Assertion failure: !JSID_IS_VOID(lastProp->id)," with gc

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = Proxy.create((function () {
    return {
        get: Object.create
    }
})([]), "")
try {
    (function () {
        for each(l in [0]) {
            print(x)
        }
    })()
} catch (e) {}
gc()
for each(let a in [0]) {
    print(x)
}

asserts js debug shell on TM changeset e8ee411dca70 without -j at Assertion failure: !JSID_IS_VOID(lastProp->id), when passed in as a CLI argument.

s-s because this involves gc..

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably related to bug 558451.

Regression window:

http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=be9979b4c10b&tochange=f3e58c264932

Comment 2

[Brendan Eich [:brendan]]

Another WFM that wants to be FIXED with fix-patch bug citation.

/be

Comment 3

[Jesse Ruderman]

The first good revision is:
changeset:   52696:ef7cd335c64e
parent:      52694:d575f16c7f55
parent:      51607:f3e58c264932
user:        David Mandelin <[e-mail]>
date:        Mon Aug 30 15:19:36 2010 -0700
summary:     [JAEGER] Merge from Tracemonkey.

Comment 4

[Jesse Ruderman]

The common ancestor of those changesets is the completely busted:

changeset:   51604:e5958cd4a135
user:        Brendan Eich <[e-mail]>
date:        Sun Aug 29 11:57:08 2010 -0700
summary:     Merge JSScope into JSObject and JSScopeProperty (now js::Shape; bug 558451, r=jorendorff).

Comment 5

[Jesse Ruderman]

I suspect hg bisect is correct, but it's hard to tell.  And if it is correct, we don't really know what fixed the bug.

In the future, PLEASE don't land on top of brokenness and then back out the brokenness by hand.  And for the sake of all that is sane, don't merge between project branches unless both are green.

Comment 6

[Jesse Ruderman]

Brendan says "if bug 595365 was not involved in fixing the problem, then it must have been bug 593256".

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929