IonMonkey: "Assertion failure: !val.isMagic()," or "Assertion failure: data.s.payload.why == why,"

RESOLVED FIXED in mozilla21

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla21
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 707228 [details]
stacks

(function([{x}]) {})({
    t: 0,
    "1": 0
})

asserts js debug shell on m-c changeset 80fed51ae074 with --ion-eager at Assertion failure: !val.isMagic(),

(function([[x]]) {})({
    t: 0,
    "1": 0
})

asserts js debug shell on m-c changeset 80fed51ae074 with --ion-eager at Assertion failure: data.s.payload.why == why,

(both point to bug 832364)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   119980:e6d6b014a076
parent:      119968:d802d6faa080
user:        Brian Hackett
date:        Sat Jan 26 13:21:27 2013 -0700
summary:     Bug 832364 - Generate optimized paths for element accesses on native objects, r=jandem.
(Reporter)

Comment 1

5 years ago
Brian, is bug 832364 the likely regressor?
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 2

5 years ago
Created attachment 707594 [details] [diff] [review]
patch

This bug was exposed by bug 832364, but it's actually a regression from bug 827490.  When we encounter object literals in global code we change their type according to what properties they have, but were totally ignoring any dense elements on the objects so that their type information was incorrect.
Assignee: general → bhackett1024
Attachment #707594 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)

Updated

5 years ago
Attachment #707594 - Flags: review?(jdemooij) → review+
(Reporter)

Updated

5 years ago
Blocks: 827490
No longer blocks: 832364
https://hg.mozilla.org/mozilla-central/rev/42a89eaa94e0
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.