Closed Bug 928268 Opened 7 years ago Closed 7 years ago

"Assertion failure: !uninlinedIsProxy()" with ion eager in browser

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla27

People

(Reporter: jruderman, Assigned: bhackett1024)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

q1-j.html
475 bytes, text/html
Details
stack
16.52 KB, text/plain
Details
patch
607 bytes, patch
jandem
: review+
Details | Diff | Splinter Review
Attached file q1-j.html — 
With:
  user_pref("javascript.options.ion.unsafe_eager_compilation", true);

the testcase trips:

Assertion failure: !uninlinedIsProxy(), at js/src/jsobj.h:466
Attached file stack — 
Do you have a regression range?
Based on the stack it's probably a regression from the recent TI changes.
Flags: needinfo?(bhackett1024)
Attached patch patch — — Splinter Review 
This assert is bogus, getProto() will return a 0x1 JSObject* for proxies with a lazy prototype, but this call site will immediately coerce that JSObject* into a TaggedProto and callers will handle the 0x1 correctly.
Assignee: nobody → bhackett1024
Attachment #819035 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Bogus assert, not s-s.
Group: core-security
Attachment #819035 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/d1b98bebc941
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.