Assert isObject() with function increment

RESOLVED DUPLICATE of bug 618007

Status

()

Core
JavaScript Engine
RESOLVED DUPLICATE of bug 618007
7 years ago
7 years ago

People

(Reporter: decoder, Assigned: adrake)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: softblocker)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

7 years ago
The following code asserts in shell on mozilla-central-trunk:

var foo;

testFoo(0);
testFoo(0);

function testFoo(i)
{
  foo = getFoo(i);
}

function getFoo(i)
{
  getFoo++;
}


Assertion failure: isObject(), at jsvalue.h:602
(Assignee)

Comment 1

7 years ago
Bisecting on tracemonkey yields:

changeset:   52243:db403b4edf3e
parent:      52220:9889018ba3cf
parent:      52242:68f7019ffed5
user:        David Anderson <dvander@alliedmods.net>
date:        Mon Jul 05 18:07:39 2010 -0700
summary:     [JAEGER] Merge from fatval & TM.

changeset:   52244:0ea22d1ff97e
user:        David Anderson <dvander@alliedmods.net>
date:        Mon Jul 05 20:14:42 2010 -0700
summary:     [JAEGER] Unbroke build, merge merge merge.
(Assignee)

Comment 2

7 years ago
After further digging behind that merge, the actual first bad revision is:

changeset:   51981:56ac5ae1825d
user:        David Anderson <danderson@mozilla.com>
date:        Thu Jun 10 23:43:14 2010 -0700
summary:     [JAEGER] Statically bind some global functions (bug 562729, r=brendan).
To clarify:  it asserts with 'js' and 'js -j'.  It runs correctly with 'js -m' or any other invocation involving '-m'.

It's a regression.  I bisected it to the JM merge :(
Looks like adrake beat me to it and did a better job!
Nominating as blocking2.0 because it's a regression.
blocking2.0: --- → ?
Keywords: assertion, regression, testcase
(Assignee)

Comment 6

7 years ago
The problem is caused by INCGLOBAL/DECGLOBAL/GLOBALINC/GLOBALDEC not properly invalidating the shape if incrementing something other than an integer. I copied the logic to do this from SETGLOBAL/FORGLOBAL, and it appears to have fixed the regression.

Patch against tip forthcoming.
(Assignee)

Updated

7 years ago
Assignee: general → adrake
(Assignee)

Comment 7

7 years ago
Created attachment 499622 [details] [diff] [review]
Patch v0

Patch against tip. Doesn't regress any jstests and fixes given test case.
(Assignee)

Comment 8

7 years ago
Created attachment 499792 [details] [diff] [review]
Patch v1

With regression test for test suite.
Attachment #499622 - Attachment is obsolete: true
(Assignee)

Comment 9

7 years ago
Bug 618007 removes the INCGLOBAL/DECGLOBAL/etc ops entirely, rendering this fix obsolete when that one lands.
(Assignee)

Updated

7 years ago
Depends on: 618007
blocking2.0: ? → betaN+
Whiteboard: softblocker
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 618007
(Reporter)

Updated

7 years ago
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.