Closed Bug 770762 Opened 12 years ago Closed 12 years ago

IonMonkey: "Assertion failure: !unknownObject(),"

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(1 file)

Attached file stack from Windows 7
function first(a) {
  return a[0];
}
function g() {
  first([function() {}])();
}
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
g();
g();

asserts js debug shell on IonMonkey changeset 5d9e10b2f586 with --no-jm and --ion-eager at Assertion failure: !unknownObject(),
Super thanks go out to Jesse for helping to reduce this testcase from being hundreds of lines long.
Note to self:

17db7530ad47 does not assert
5d9e10b2f586 asserts

(not yet the smallest window)
Due to skipped revisions, the first bad revision could be any of:
changeset:   99566:51c5ea99a47e
user:        Kannan Vijayan
date:        Tue Jul 03 14:36:10 2012 -0400
summary:     Bug 729278 - Add IR instructions for inline function guards. (r=mjrosenb)

changeset:   99567:54558ba6a5d6
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:12 2012 -0400
summary:     Bug 729278 - Refactor inline_call infrastructure to prepare for polymorphic inlining. (r=mjrosenb)

changeset:   99568:8523fd225c0d
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:39 2012 -0400
summary:     Bug 729278 - Add polymorphic inlining logic. (r=mjrosenb)

changeset:   99569:c83f8157e50d
user:        Kannan Vijayan
date:        Tue Jul 03 15:40:00 2012 -0400
summary:     Bug 729278 - Fix codegen for InlineFunctionGuard. (r=tbpl-red)


However, it was likely fixed by:

changeset:   99571:45315f6ccb19
user:        Kannan Vijayan
date:        Tue Jul 03 17:56:08 2012 -0400
summary:     Bug 729278 - Fix error in getPolyCallTargets (r=orange).
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Kannan, will it be possible for you to check in this testcase to the testsuite?
Sure.
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug770762.js.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.