Last Comment Bug 783590 - IonMonkey: "Assertion failure: !isOwn,"
: IonMonkey: "Assertion failure: !isOwn,"
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Mac OS X
-- critical (vote)
: ---
Assigned To: Eric Faust [:efaust]
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-08-17 09:45 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 07:37 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (11.02 KB, text/plain)
2012-08-17 09:45 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Fix (1.72 KB, patch)
2012-08-17 16:10 PDT, Eric Faust [:efaust]
sstangl: review+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2012-08-17 09:45:12 PDT
Created attachment 652797 [details]

var glob = this;
var arr = [];
Object.defineProperty(arr, 0, {
  get: (function() {
});"s", function() {});
try {
} catch (e) {}

asserts js debug shell on IonMonkey changeset d794f23798f4 with --no-jm and --ion-eager at Assertion failure: !isOwn,

(not sure if this is correct):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   101425:adb60cc7b150
parent:      100948:5d1128ed64af
parent:      101424:9b876829ed32
user:        David Anderson
date:        Wed Jul 18 19:02:32 2012 -0700
summary:     Merge from mozilla-central.
Comment 1 User image Eric Faust [:efaust] 2012-08-17 16:10:59 PDT
Created attachment 652968 [details] [diff] [review]

The bug was that we were trying to only deal with on setters, but because of TI limitations, we need to refuse getters as well in the presence of watched objects on the prototype chain.
Comment 2 User image Eric Faust [:efaust] 2012-08-18 02:23:12 PDT
Comment 3 User image Christian Holler (:decoder) 2013-01-14 07:37:55 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug783590.js.

Note You need to log in before you can comment on or make changes to this bug.