829795 - "Assertion failure: !fe->isConstant(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    x = [];
    Array.prototype.forEach()
} catch (e) {}
x.forEach()

asserts js debug shell on m-c changeset 44dcffe8792b with -a at Assertion failure: !fe->isConstant(),


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   118493:f4671ccc4502
user:        Brian Hackett
date:        Thu Jan 10 17:53:11 2013 -0700
summary:     Bug 827490 - Allow native objects to have both slots and dense elements, rm dense/slow array distinction, r=billm, dvander.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 827490 a likely regressor?

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Fix some spots the method JIT wasn't tolerating accesses on statically known dense arrays (which can crop up now, though only for Array.prototype).

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/809dac438e94

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/809dac438e94

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397