774953 - "Assertion failure: [infer failure] Missing type pushed 0" with iframes, adoptNode

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase

With
  user_pref("javascript.options.methodjit_always", true);
the testcase triggers:

Assertion failure: [infer failure] Missing type pushed 0: [0x10a0398e0], at js/src/jsinfer.cpp:325

Based on js/xpconnect/crashtests/515726-1.html

Comment 1

[Jesse Ruderman]

Attachment: TI spew & stack trace

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

I'm in the process of bisecting this. It is a bug on mozilla-central but is only causing problems on the IonMonkey TBPL for some reason.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Bisected to bug 766447.

Comment 6

[Eric Faust [:efaust]]

The problem has something to do with the proto->setNewTypeUnknown() call that was removed from JS_NewObject(). The problem seems to be that if the objects are swap()ed, then the type information will be inaccurate.

Comment 7

[Brian Hackett [Laid off!]]

Attachment: patch

This passes the testcases in this bug and bug 779020 (got the crash without the patch in bug 779020, didn't test with this one).  The problem is that JSObject::swap swaps the two types of the objects, which will break the correctness of type sets which either object appeared in if the objects have not had all sets they appear in marked as unknown.  This fix keeps the type of an object stable across swaps, though it will get SetProto'ed to get the prototype of the other object which will mark its sets as unknown anyways.

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 651062 [details] [diff] [review]
patch

Thanks!

Comment 9

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d093de44e850

Comment 10

[Phil Ringnalda (:philor)]

Backed out in http://hg.mozilla.org/integration/mozilla-inbound/rev/b753e1dce89f - mochitest-chrome, "dom/tests/mochitest/whatwg/test_postMessage_chrome.html | Test timed out," so far looking like every OS and opt+debug.

Comment 11

[Brian Hackett [Laid off!]]

ReserveForTradeGuts had a premature return that skipped the prototype swapping.

https://hg.mozilla.org/integration/mozilla-inbound/rev/d29b79c37f86

Comment 12

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d29b79c37f86

Comment 13

[Alex Keybl [:akeybl]]

Marking as unaffected since bug 766447, the regressing bug, landed in FF16.

Comment 14

[Matt Wobensmith [:mwobensmith][:matt:]]

Verified.

Confirmed testcase crashes 2012-7-17 Firefox 17.0a1 Nightly Debug
Confirmed testcase crashes 2012-9-29 Firefox 16.0 Nightly Debug
Does not crash 2012-10-17 Firefox 17.0b2