Closed Bug 783590 Opened 12 years ago Closed 12 years ago

IonMonkey: "Assertion failure: !isOwn,"

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: efaust)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file stack
var glob = this;
var arr = [];
Object.defineProperty(arr, 0, {
  get: (function() {
    glob.__proto__;
  })
});
this.watch("s", function() {});
try {
  arr.pop();
} catch (e) {}
arr.pop();


asserts js debug shell on IonMonkey changeset d794f23798f4 with --no-jm and --ion-eager at Assertion failure: !isOwn,

(not sure if this is correct):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   101425:adb60cc7b150
parent:      100948:5d1128ed64af
parent:      101424:9b876829ed32
user:        David Anderson
date:        Wed Jul 18 19:02:32 2012 -0700
summary:     Merge from mozilla-central.
Attached patch FixSplinter Review
The bug was that we were trying to only deal with Object.watch on setters, but because of TI limitations, we need to refuse getters as well in the presence of watched objects on the prototype chain.
Attachment #652968 - Flags: review?(sstangl)
Assignee: general → efaustbmo
Status: NEW → ASSIGNED
Attachment #652968 - Flags: review?(sstangl) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/8dfc1dbac04b
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug783590.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.