Last Comment Bug 783590 - IonMonkey: "Assertion failure: !isOwn,"
: IonMonkey: "Assertion failure: !isOwn,"
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: Eric Faust [:efaust]
: general
Mentors:
Depends on:
Blocks: jsfunfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-08-17 09:45 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 07:37 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (11.02 KB, text/plain)
2012-08-17 09:45 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Fix (1.72 KB, patch)
2012-08-17 16:10 PDT, Eric Faust [:efaust]
sstangl: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-08-17 09:45:12 PDT
Created attachment 652797 [details]
stack

var glob = this;
var arr = [];
Object.defineProperty(arr, 0, {
  get: (function() {
    glob.__proto__;
  })
});
this.watch("s", function() {});
try {
  arr.pop();
} catch (e) {}
arr.pop();


asserts js debug shell on IonMonkey changeset d794f23798f4 with --no-jm and --ion-eager at Assertion failure: !isOwn,

(not sure if this is correct):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   101425:adb60cc7b150
parent:      100948:5d1128ed64af
parent:      101424:9b876829ed32
user:        David Anderson
date:        Wed Jul 18 19:02:32 2012 -0700
summary:     Merge from mozilla-central.
Comment 1 Eric Faust [:efaust] 2012-08-17 16:10:59 PDT
Created attachment 652968 [details] [diff] [review]
Fix

The bug was that we were trying to only deal with Object.watch on setters, but because of TI limitations, we need to refuse getters as well in the presence of watched objects on the prototype chain.
Comment 2 Eric Faust [:efaust] 2012-08-18 02:23:12 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/8dfc1dbac04b
Comment 3 Christian Holler (:decoder) 2013-01-14 07:37:55 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug783590.js.

Note You need to log in before you can comment on or make changes to this bug.