879726 - Crash [@ defaultValue] with Array.join

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8f9ba85eb61c (run with --ion-eager):


function testUndefinedBooleanCmp() {
    var t = true, x = [];
    for (var i = 0; i < 10; ++i) {
        x[(null)] = t 
        x[3] = t 
        x[4] = x;
    }
    return x.join(",");
}
testUndefinedBooleanCmp();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/3835cbed5915
user:        Nicolas B. Pierron
date:        Fri May 24 14:58:08 2013 -0700
summary:     Bug 774006 - IonMonkey: Implement SetElementIC for integer indexes. r=h4writer

This iteration took 0.953 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from Nicolas based on comment 2 :)

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b7175c5829b5).

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, failed due to error (try manually).

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, failed due to error (try manually).

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(I'll be looking to fix up the harness errors)

Comment 8

[Christian Holler (:decoder)]

Fwiw, the bisection failures comes from a broken range within mozilla-central. It's likely that an update to current autobisect will fix this and we'll look into that tomorrow.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/5efe6470e752
user:        Hannes Verschore
date:        Fri Jun 14 17:26:28 2013 -0700
summary:     Bug 881470. r=jandem

Hannes, is bug 881470 a likely fix?

Comment 10

[Hannes Verschore [:h4writer]]

Yes, that is a likely fix for the testcase and issue provided.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Marking FIXED by bug 881470.