Closed Bug 895782 Opened 8 years ago Closed 8 years ago

Assertion failure: dispatch->numCases() > 0, at ion/IonBuilder.cpp

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: gkw, Assigned: shu)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack
Object.defineProperty(this, "y", {
    get: function() {
        return Object.create(x)
    }
})
x = ParallelArray([1142], function() {})
x = x.partition(2)
y + y

asserts js debug shell on m-c changeset 0d0263a58f06 without any CLI arguments at Assertion failure: dispatch->numCases() > 0, at ion/IonBuilder.cpp

Going to assume this is ParallelArray first, pending the bisection.
Flags: needinfo?(shu)
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0960402d8145
user:        Jan de Mooij
date:        Tue Jul 16 21:34:02 2013 +0200
summary:     Bug 852421 - Remove MarkTypeObjectUnknownProperties call from Object.create. r=bhackett

This iteration took 342.591 seconds to run.
This is fallout from bug 894782. There are other sites where originals is supposed to be used instead of targets that wasn't caught.
Flags: needinfo?(shu)
Err, not quite fallout, the last fix just didn't cover all the cases.
Attached patch fix + testcaseSplinter Review
The remaining uses of "targets" in inlineCalls look okay to me...
Assignee: general → shu
Attachment #778382 - Flags: review?(jdemooij)
Attachment #778382 - Flags: review?(jdemooij) → review+
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision b717a7945dfb).
https://hg.mozilla.org/mozilla-central/rev/36e656434fb3
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
You need to log in before you can comment on or make changes to this bug.