Last Comment Bug 780842 - IonMonkey: Assertion failure: id == MakeTypeId(cx, id), at ../jsinferinlines.h:1401
: IonMonkey: Assertion failure: id == MakeTypeId(cx, id), at ../jsinferinlines....
[ion:p1:fx18] [jsbugmon:update,ignore]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Linux
-- major (vote)
: ---
Assigned To: general
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-08-07 02:02 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:45 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Ensure normalized property id in annotateGetPropertyCache (853 bytes, patch)
2012-08-09 21:07 PDT, Kannan Vijayan [:djvj]
jdemooij: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-08-07 02:02:31 PDT
The following testcase asserts on ionmonkey revision 15db586f9a12 (run with --ion -n -m --ion-eager -a):

function testUKeyUObject(a, key1, key2, key3) {
    assertEq(a[-1](), "hi");
for (var i = 0; i < 5; i++) {
    testUKeyUObject({}, "a", "b", "c");
Comment 1 User image David Anderson [:dvander] 2012-08-09 18:19:34 PDT
Kannan, this looks like poly inlining fallout. I think we just need an (id == MakeTypeId(id)) check in the loop under IonBuilder::annotateGetPropertyCache?
Comment 2 User image Kannan Vijayan [:djvj] 2012-08-09 21:07:49 PDT
Created attachment 650777 [details] [diff] [review]
Ensure normalized property id in annotateGetPropertyCache

Yep, but we can do the check up at the beginning instead of in each loop iteration.
Comment 3 User image Jan de Mooij [:jandem] 2012-08-10 02:59:50 PDT
Btw, please also add the test case.
Comment 4 User image Christian Holler (:decoder) 2012-08-10 08:46:36 PDT
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4121663806d0).
Comment 6 User image Christian Holler (:decoder) 2013-01-14 08:45:36 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug780842.js.

Note You need to log in before you can comment on or make changes to this bug.