770762 - IonMonkey: "Assertion failure: !unknownObject(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack from Windows 7

function first(a) {
  return a[0];
}
function g() {
  first([function() {}])();
}
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
g();
g();

asserts js debug shell on IonMonkey changeset 5d9e10b2f586 with --no-jm and --ion-eager at Assertion failure: !unknownObject(),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Super thanks go out to Jesse for helping to reduce this testcase from being hundreds of lines long.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Note to self:

17db7530ad47 does not assert
5d9e10b2f586 asserts

(not yet the smallest window)

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset:   99566:51c5ea99a47e
user:        Kannan Vijayan
date:        Tue Jul 03 14:36:10 2012 -0400
summary:     Bug 729278 - Add IR instructions for inline function guards. (r=mjrosenb)

changeset:   99567:54558ba6a5d6
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:12 2012 -0400
summary:     Bug 729278 - Refactor inline_call infrastructure to prepare for polymorphic inlining. (r=mjrosenb)

changeset:   99568:8523fd225c0d
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:39 2012 -0400
summary:     Bug 729278 - Add polymorphic inlining logic. (r=mjrosenb)

changeset:   99569:c83f8157e50d
user:        Kannan Vijayan
date:        Tue Jul 03 15:40:00 2012 -0400
summary:     Bug 729278 - Fix codegen for InlineFunctionGuard. (r=tbpl-red)


However, it was likely fixed by:

changeset:   99571:45315f6ccb19
user:        Kannan Vijayan
date:        Tue Jul 03 17:56:08 2012 -0400
summary:     Bug 729278 - Fix error in getPolyCallTargets (r=orange).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Kannan, will it be possible for you to check in this testcase to the testsuite?

Comment 5

[Kannan Vijayan [:djvj]]

Sure.

Comment 6

[Kannan Vijayan [:djvj]]

(see comment 4 and 5)
https://hg.mozilla.org/projects/ionmonkey/rev/8b64cd2f4fab

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug770762.js.