888837 - Assertion failure: ionScript->containsReturnAddress(returnAddr), at ion/IonFrames.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

z = Object.defineProperty(this, "x", {
    get: function() {
        return ParallelArray([221], (function() {
            (function(y) {
                z.h
            })()
        }))
    }
})
x

asserts 32-bit threadsafe js debug shell on m-c changeset e24391ffbe7e without any CLI arguments at Assertion failure: ionScript->containsReturnAddress(returnAddr), at ion/IonFrames.cpp

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/286594159989
user:        Shu-yu Guo
date:        Wed Apr 10 11:04:24 2013 -0700
summary:     Bug 846111 - Part 3: Dispatch style ICs in Ion and ParallelGetPropertyIC. (r=nbp)

Comment 1

[Shu-yu Guo [:shu]]

Attachment: fix

Comment 3

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bbda33d547a9

try: https://tbpl.mozilla.org/?tree=Try&rev=dcc924a0d06e

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/bbda33d547a9