759213 - IonMonkey: Assertion failure: isObject(), at ../../jsapi.h:476 or Crash [@ js::UnwindIteratorForUncatchableException]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 4ce3983a43f4 (run with --ion -n -m --ion-eager):


function testNestedForIn() {
    var a = {x: 1, y: (/\\u00fd[]/ ), z: 3};
    for (var p1 in a)
        for (var { w  }  = 0     ;  ;    )
            testJSON(t);
}
assertEq(testNestedForIn(), 'xx xy xz yx yy yz zx zy zz ');

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

The bug is that an inner loop creates a phi for an iterator object, but this phi is not observable so it gets removed. The fix here should scale easily to chunked compilation.

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 628371 [details] [diff] [review]
fix

Review of attachment 628371 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/0930379f5cfa

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug759213.js.