716743 - IonMonkey: "Assertion failure: (objBits >> 47) == 0,"

Status: VERIFIED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function(o) {
    o.p
})({})

asserts js debug shell on IM changeset 5f2390059e5f with --ion-eager and -n at Assertion failure: (objBits >> 47) == 0,

(Testing things out since IM is *almost* ready for fuzzing)

autoBisect shows this is probably related to the following changeset: (not sure if it's correct)

The first bad revision is:
changeset:   83907:edde637d2661
user:        Brian Hackett
date:        Fri Dec 23 10:11:45 2011 -0800
summary:     Add inline cache for GETPROP, bug 707854. r=dvander

Comment 1

[Jan de Mooij [:jandem]]

Pretty sure this is bug 715111.

Comment 3

[Hannes Verschore [:h4writer]]

As extra information this only happens on 64bit

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

Yup, same problem, will bucket this very nice testcase in.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Test case checked in: http://hg.mozilla.org/projects/ionmonkey/rev/3cfe28eaa62b

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.