IonMonkey: "Assertion failure: !unknownObject(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Other Branch
x86
Windows 7
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 638934 [details]
stack from Windows 7

function first(a) {
  return a[0];
}
function g() {
  first([function() {}])();
}
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
g();
g();

asserts js debug shell on IonMonkey changeset 5d9e10b2f586 with --no-jm and --ion-eager at Assertion failure: !unknownObject(),
(Reporter)

Comment 1

5 years ago
Super thanks go out to Jesse for helping to reduce this testcase from being hundreds of lines long.
(Reporter)

Comment 2

5 years ago
Note to self:

17db7530ad47 does not assert
5d9e10b2f586 asserts

(not yet the smallest window)
(Reporter)

Comment 3

5 years ago
Due to skipped revisions, the first bad revision could be any of:
changeset:   99566:51c5ea99a47e
user:        Kannan Vijayan
date:        Tue Jul 03 14:36:10 2012 -0400
summary:     Bug 729278 - Add IR instructions for inline function guards. (r=mjrosenb)

changeset:   99567:54558ba6a5d6
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:12 2012 -0400
summary:     Bug 729278 - Refactor inline_call infrastructure to prepare for polymorphic inlining. (r=mjrosenb)

changeset:   99568:8523fd225c0d
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:39 2012 -0400
summary:     Bug 729278 - Add polymorphic inlining logic. (r=mjrosenb)

changeset:   99569:c83f8157e50d
user:        Kannan Vijayan
date:        Tue Jul 03 15:40:00 2012 -0400
summary:     Bug 729278 - Fix codegen for InlineFunctionGuard. (r=tbpl-red)


However, it was likely fixed by:

changeset:   99571:45315f6ccb19
user:        Kannan Vijayan
date:        Tue Jul 03 17:56:08 2012 -0400
summary:     Bug 729278 - Fix error in getPolyCallTargets (r=orange).
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
(Reporter)

Comment 4

5 years ago
Kannan, will it be possible for you to check in this testcase to the testsuite?
Sure.
(see comment 4 and 5)
https://hg.mozilla.org/projects/ionmonkey/rev/8b64cd2f4fab
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug770762.js.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.