835496 - IonMonkey: "Assertion failure: !val.isMagic()," or "Assertion failure: data.s.payload.why == why,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

(function([{x}]) {})({
    t: 0,
    "1": 0
})

asserts js debug shell on m-c changeset 80fed51ae074 with --ion-eager at Assertion failure: !val.isMagic(),

(function([[x]]) {})({
    t: 0,
    "1": 0
})

asserts js debug shell on m-c changeset 80fed51ae074 with --ion-eager at Assertion failure: data.s.payload.why == why,

(both point to bug 832364)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   119980:e6d6b014a076
parent:      119968:d802d6faa080
user:        Brian Hackett
date:        Sat Jan 26 13:21:27 2013 -0700
summary:     Bug 832364 - Generate optimized paths for element accesses on native objects, r=jandem.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 832364 the likely regressor?

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

This bug was exposed by bug 832364, but it's actually a regression from bug 827490.  When we encounter object literals in global code we change their type according to what properties they have, but were totally ignoring any dense elements on the objects so that their type information was incorrect.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/42a89eaa94e0

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/42a89eaa94e0