Closed Bug 876539 Opened 7 years ago Closed 6 years ago

Assertion failure: !hasLazyType(), at ../vm/ObjectImpl.h:1329

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 918584

People

(Reporter: decoder, Assigned: jandem)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:])

Attachments

(2 files)

The following testcase asserts on mozilla-central revision a39263b0c896 (run with --ion-eager):


function f(x) {}
evaluate('f.prototype["undefined"] = ""', { noScriptRval : true });
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132895:e1bca8b56470
user:        Jan de Mooij
date:        Fri May 24 14:03:31 2013 +0200
summary:     Bug 868431 - Disable Ion when Baseline is disabled, remove bailout-to-interpreter code. r=djvj

This iteration took 0.864 seconds to run.
Needinfo from Jan based on comment 2 :)
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
Use obj->getType(cx) instead of obj->type() in Ion SetPropertyIC::attachNativeAdding to handle objects with a lazy type.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #754770 - Flags: review?(bhackett1024)
Flags: needinfo?(jdemooij)
Attachment #754770 - Flags: review?(bhackett1024) → review+
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9ca690835a5e).
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7df36088f645
user:        Kannan Vijayan
date:        Wed Jun 05 16:42:23 2013 -0400
summary:     Bug 877287. r=h4writer

This iteration took 340.070 seconds to run.
Djvj, did comment 6 fix this?
Flags: needinfo?(kvijayan)
Doesn't seem like it.  Jan should still land the patch for this.
Flags: needinfo?(kvijayan)
Jan, is this patch still needed?
Flags: needinfo?(jdemooij)
(In reply to Gary Kwong [:gkw] [:nth10sd] (yes, still catching up on bugmail) from comment #9)
> Jan, is this patch still needed?

No, shu's SetPropertyIC refactoring (bug 918584) should have fixed this. SetPropertyIC::update now calls obj->getType(cx) so it's safe for GenerateAddSlot to use obj->type().
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Flags: needinfo?(jdemooij)
Resolution: --- → DUPLICATE
Duplicate of bug: 918584
You need to log in before you can comment on or make changes to this bug.