858077 - Assertion failure: !unknownObject(), at ../jsinferinlines.h:1519 with ParallelArray

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c232bec6974d (no options required):


var a = new ParallelArray([1,2,3,4]);
for (var i = 0; i < 9 && i > -1000; i-- )
    a[i] += [0];

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   127434:e5978106c61a
parent:      127433:280e5ed3f0b7
parent:      125575:1d6fe70c79c5
user:        Jan de Mooij
date:        Thu Mar 21 11:23:12 2013 +0100
summary:     Merge from mozilla-central.

Not all ancestors of this changeset have been checked.
Use bisect --extend to continue the bisection from
the common ancestor, 0bba6ba92467.

This iteration took 146.421 seconds to run.

Oops! We didn't test rev 1d6fe70c79c5, a parent of the blamed revision! Let's do that now.
Rev 1d6fe70c79c5: Found cached shell...   Testing... [Uninteresting] It didn't crash. (0.232 seconds)
good (not interesting) 
As expected, the parent's label is the opposite of the blamed rev's label.

Comment 2

[Niko Matsakis [:nmatsakis]]

Attachment: Check for unknown object flag

Comment 3

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/68dfccf515c0

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/68dfccf515c0