IonMonkey: "Assertion failure: !val.isMagic()," or "Assertion failure: data.s.payload.why == why,"

RESOLVED FIXED in mozilla21

Status

()

defect
--
critical
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

Trunk
mozilla21
x86_64
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

Posted file stacks
(function([{x}]) {})({
    t: 0,
    "1": 0
})

asserts js debug shell on m-c changeset 80fed51ae074 with --ion-eager at Assertion failure: !val.isMagic(),

(function([[x]]) {})({
    t: 0,
    "1": 0
})

asserts js debug shell on m-c changeset 80fed51ae074 with --ion-eager at Assertion failure: data.s.payload.why == why,

(both point to bug 832364)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   119980:e6d6b014a076
parent:      119968:d802d6faa080
user:        Brian Hackett
date:        Sat Jan 26 13:21:27 2013 -0700
summary:     Bug 832364 - Generate optimized paths for element accesses on native objects, r=jandem.
Brian, is bug 832364 the likely regressor?
Flags: needinfo?(bhackett1024)
Posted patch patchSplinter Review
This bug was exposed by bug 832364, but it's actually a regression from bug 827490.  When we encounter object literals in global code we change their type according to what properties they have, but were totally ignoring any dense elements on the objects so that their type information was incorrect.
Assignee: general → bhackett1024
Attachment #707594 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #707594 - Flags: review?(jdemooij) → review+
Blocks: 827490
No longer blocks: 832364
https://hg.mozilla.org/mozilla-central/rev/42a89eaa94e0
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.