IonMonkey: Assertion failure: id == MakeTypeId(cx, id), at ../jsinferinlines.h:1401

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision 15db586f9a12 (run with --ion -n -m --ion-eager -a):


function testUKeyUObject(a, key1, key2, key3) {
    assertEq(a[-1](), "hi");
}
for (var i = 0; i < 5; i++) {
    testUKeyUObject({}, "a", "b", "c");
}
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
Kannan, this looks like poly inlining fallout. I think we just need an (id == MakeTypeId(id)) check in the loop under IonBuilder::annotateGetPropertyCache?
Created attachment 650777 [details] [diff] [review]
Ensure normalized property id in annotateGetPropertyCache

Yep, but we can do the check up at the beginning instead of in each loop iteration.
Attachment #650777 - Flags: review?(jdemooij)

Updated

5 years ago
Attachment #650777 - Flags: review?(jdemooij) → review+
Btw, please also add the test case.
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update][ion:p1:fx18] → [ion:p1:fx18] [jsbugmon:update,ignore]
(Reporter)

Comment 4

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4121663806d0).
https://hg.mozilla.org/projects/ionmonkey/rev/4121663806d0
https://hg.mozilla.org/projects/ionmonkey/rev/a129da8fe7eb
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 6

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug780842.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.