807035 - IonMonkey: "Assertion failure: pobj,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = [0, 0, 0, 0, 0, 0, 0, 0]
y = ({}).__proto__
x.sort(function() {
    y.z
})

asserts js debug shell on m-c changeset a2a201dd7a85 with --no-jm at Assertion failure: pobj, and Ion seems to be on the stack so may be related to IonMonkey.

autoBisect is underway.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   111708:4a2c17905a17
user:        Nicolas B. Pierron
date:        Mon Oct 29 14:48:45 2012 -0700
summary:     Bug 792631 - Add IC for missing properties. r=dvander

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: Skip guard insertions if there is no proto.

Do not try to add any guard if there is not prototype chain. This is similar to what I can find in the PolyIC code of JM.

Comment 5

[Nicolas B. Pierron [:nbp]]

Attachment: Skip guard insertions if there is no proto.

Same patch, not private anymore (keep review from dvander).

Do not walk the proto-chain if there is none, the object shape should still be guarded before we check the proto-chain, so this is fine to replace this assertion by an early-exit of this function.  As mentioned before JM does the same thing in the PolyIC.

Comment 6

[Nicolas B. Pierron [:nbp]]

(Try Linux x64) https://tbpl.mozilla.org/?tree=Try&rev=88e71901b6eb
https://hg.mozilla.org/integration/mozilla-inbound/rev/d551b523fbcd

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d551b523fbcd

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug807035.js.