595921 - JM: "Assertion failure: newShape != initialShape,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = <x/>
function f(aaa) {
    aaa.e = x
}
for each(let c in [x, x, x]) {
    f(c)
}

asserts js debug shell on TM changeset f5e128da7b5f with -m at Assertion failure: newShape != initialShape,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   53114:9a8b156c7396
user:        Brian Hackett
date:        Sat Sep 04 20:12:56 2010 -0700
summary:     PIC for addprop, bug 561506. r=dmandelin

Comment 2

[Brian Hackett [Laid off!]]

Attachment: fix

This disables the setprop pic for objects with custom setProperty/ops.setProperty/ops.lookupProperty hooks, and the addprop pic for objects with custom addProperty/ops.defineProperty hooks.  These won't catch js_ObjectClass or js_CallClass.

Comment 3

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/tracemonkey/rev/708c6d2e33ee

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/708c6d2e33ee

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug595921.js.