831424 - IonMonkey: "Assertion failure: isObject(),"

Status: VERIFIED DUPLICATE of bug 818023

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = [];
Object.defineProperty(this, "y", {
    get: function() {
        FakeDOMObject.caller
    }
});
Object.defineProperty(x, 3, {
    get: function() {
        y[13];
    }
});
(function() {
    x.shift();
})();

asserts js debug shell on m-c changeset 8d8912467c41 with --ion-eager at Assertion failure: isObject(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   116633:91dae8287643
user:        Jan de Mooij
date:        Thu Dec 20 15:27:54 2012 +0100
summary:     Bug 822385 - Add getter, setter and method with jitinfo to the shell. r=bz

(I'm a little suspicious here - bug 822385 might just have exposed the problem)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jandem, do you think bug 822385 is the correct regressor here?

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] from comment #1)
> jandem, do you think bug 822385 is the correct regressor here?

No, it asserts also if I replace "FakeDOMObject" with "print". Can you run autoBisect with that change?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = [];
Object.defineProperty(this, "y", {
    get: function() {
        print.caller
    }
});
Object.defineProperty(x, 3, {
    get: function() {
        y[13];
    }
});
(function() {
    x.shift();
})();

is jandem's suggested testcase that also asserts.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   106741:6cd206b37176
parent:      106740:b63bb39ed1c0
parent:      103644:a0240c1043ee
user:        David Anderson
date:        Wed Aug 29 17:51:24 2012 -0700
summary:     Merge from mozilla-central.

Not all ancestors of this changeset have been checked.
Use bisect --extend to continue the bisection from
the common ancestor, 88e47f6905e9.

This iteration took 1.330 seconds to run.

Oops! We didn't test rev a0240c1043ee, a parent of the blamed revision! Let's do that now.
We did not test rev a0240c1043ee because it is not a descendant of either 4ceb3e9961e4 or 8d8912467c41.
Rev a0240c1043ee: Found cached shell...   Testing... good (Exit code 1 or 2 - js shell quits because it does not support a given CLI parameter) 
As expected, the parent's label is the opposite of the blamed rev's label.

This may have stemmed from the IonMonkey landing.

Comment 4

[Christian Holler (:decoder)]

It's likely a dup of one of the other isObject bugs that are open :)

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Christian Holler (:decoder) from comment #4)
> It's likely a dup of one of the other isObject bugs that are open :)

I had found bug 806344 and bug 822223, but they both seem to involve gc and this bug doesn't have gc anywhere.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Looks like this was fixed by bug 818023.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcase landed via bug 845569.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Gary Kwong [:gkw] from comment #7)
> Testcase landed via bug 845569.

(fwiw, I landed the testcases in comment 0 and comment 3.)