Last Comment Bug 770762 - IonMonkey: "Assertion failure: !unknownObject(),"
: IonMonkey: "Assertion failure: !unknownObject(),"
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Windows 7
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-07-03 18:16 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 07:52 PST (History)
8 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack from Windows 7 (9.43 KB, text/plain)
2012-07-03 18:16 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2012-07-03 18:16:12 PDT
Created attachment 638934 [details]
stack from Windows 7

function first(a) {
  return a[0];
}
function g() {
  first([function() {}])();
}
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
first([function() {}]);
g();
g();

asserts js debug shell on IonMonkey changeset 5d9e10b2f586 with --no-jm and --ion-eager at Assertion failure: !unknownObject(),
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-07-03 18:17:00 PDT
Super thanks go out to Jesse for helping to reduce this testcase from being hundreds of lines long.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-07-03 18:22:05 PDT
Note to self:

17db7530ad47 does not assert
5d9e10b2f586 asserts

(not yet the smallest window)
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-07-03 18:58:21 PDT
Due to skipped revisions, the first bad revision could be any of:
changeset:   99566:51c5ea99a47e
user:        Kannan Vijayan
date:        Tue Jul 03 14:36:10 2012 -0400
summary:     Bug 729278 - Add IR instructions for inline function guards. (r=mjrosenb)

changeset:   99567:54558ba6a5d6
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:12 2012 -0400
summary:     Bug 729278 - Refactor inline_call infrastructure to prepare for polymorphic inlining. (r=mjrosenb)

changeset:   99568:8523fd225c0d
user:        Kannan Vijayan
date:        Tue Jul 03 14:37:39 2012 -0400
summary:     Bug 729278 - Add polymorphic inlining logic. (r=mjrosenb)

changeset:   99569:c83f8157e50d
user:        Kannan Vijayan
date:        Tue Jul 03 15:40:00 2012 -0400
summary:     Bug 729278 - Fix codegen for InlineFunctionGuard. (r=tbpl-red)


However, it was likely fixed by:

changeset:   99571:45315f6ccb19
user:        Kannan Vijayan
date:        Tue Jul 03 17:56:08 2012 -0400
summary:     Bug 729278 - Fix error in getPolyCallTargets (r=orange).
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2012-07-03 18:59:04 PDT
Kannan, will it be possible for you to check in this testcase to the testsuite?
Comment 5 Kannan Vijayan [:djvj] 2012-07-04 08:27:20 PDT
Sure.
Comment 6 Kannan Vijayan [:djvj] 2012-07-04 13:28:55 PDT
(see comment 4 and 5)
https://hg.mozilla.org/projects/ionmonkey/rev/8b64cd2f4fab
Comment 7 Christian Holler (:decoder) 2013-01-14 07:52:41 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug770762.js.

Note You need to log in before you can comment on or make changes to this bug.