709634 - Assertion failure: isInterpreted(), at ../../jsfun.h:176

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 63bff373cb94 (options -m -n -a):


Function.prototype.toString = function () f(this, true);
function f(obj) {
  f.caller.p
}
decodeURI + 3;

Comment 1

[Jeff Walden [:Waldo]]

Tom, you want to take a look, maybe?  Our old friend .caller rears its ugly head.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

ObjShrink regression, incorrect test in one of the method optimization special cases that clones methods in frame callee slots when they are explicitly accessed with foo.callee or foo.caller.  This used to test that two functions have the same backing script using getFunctionPrivate, and now that getFunctionPrivate is gone the comparison is done by comparing the function scripts.  This botches the assert when one of the involved functions is not interpreted.  I went through the other places in the VM where equality tests are done on function scripts and didn't see anything else that needs fixing.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/dacb8e36e8bd

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/dacb8e36e8bd

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug709634.js.