928268 - "Assertion failure: !uninlinedIsProxy()" with ion eager in browser

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Jesse Ruderman]

Attachment: q1-j.html

With:
  user_pref("javascript.options.ion.unsafe_eager_compilation", true);

the testcase trips:

Assertion failure: !uninlinedIsProxy(), at js/src/jsobj.h:466

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Jan de Mooij [:jandem]]

Do you have a regression range?

Comment 3

[Jan de Mooij [:jandem]]

Based on the stack it's probably a regression from the recent TI changes.

Comment 4

[Brian Hackett (:bhackett)]

Attachment: patch

This assert is bogus, getProto() will return a 0x1 JSObject* for proxies with a lazy prototype, but this call site will immediately coerce that JSObject* into a TaggedProto and callers will handle the 0x1 correctly.

Comment 5

[Brian Hackett (:bhackett)]

Bogus assert, not s-s.

Comment 6

[Brian Hackett (:bhackett)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d1b98bebc941

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/d1b98bebc941