Closed Bug 928268 Opened 6 years ago Closed 6 years ago

"Assertion failure: !uninlinedIsProxy()" with ion eager in browser

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla27

People

(Reporter: jruderman, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file q1-j.html
With:
  user_pref("javascript.options.ion.unsafe_eager_compilation", true);

the testcase trips:

Assertion failure: !uninlinedIsProxy(), at js/src/jsobj.h:466
Attached file stack
Do you have a regression range?
Based on the stack it's probably a regression from the recent TI changes.
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
This assert is bogus, getProto() will return a 0x1 JSObject* for proxies with a lazy prototype, but this call site will immediately coerce that JSObject* into a TaggedProto and callers will handle the 0x1 correctly.
Assignee: nobody → bhackett1024
Attachment #819035 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Bogus assert, not s-s.
Group: core-security
Attachment #819035 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/d1b98bebc941
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.