895782 - Assertion failure: dispatch->numCases() > 0, at ion/IonBuilder.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Object.defineProperty(this, "y", {
    get: function() {
        return Object.create(x)
    }
})
x = ParallelArray([1142], function() {})
x = x.partition(2)
y + y

asserts js debug shell on m-c changeset 0d0263a58f06 without any CLI arguments at Assertion failure: dispatch->numCases() > 0, at ion/IonBuilder.cpp

Going to assume this is ParallelArray first, pending the bisection.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0960402d8145
user:        Jan de Mooij
date:        Tue Jul 16 21:34:02 2013 +0200
summary:     Bug 852421 - Remove MarkTypeObjectUnknownProperties call from Object.create. r=bhackett

This iteration took 342.591 seconds to run.

Comment 2

[Shu-yu Guo [:shu]]

This is fallout from bug 894782. There are other sites where originals is supposed to be used instead of targets that wasn't caught.

Comment 3

[Shu-yu Guo [:shu]]

Err, not quite fallout, the last fix just didn't cover all the cases.

Comment 4

[Shu-yu Guo [:shu]]

Attachment: fix + testcase

The remaining uses of "targets" in inlineCalls look okay to me...

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b717a7945dfb).

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/36e656434fb3