Closed Bug 936361 Opened 6 years ago Closed 6 years ago

Assertion failure: (!property.isOwnProperty(constraints())), at jit/IonBuilder.cpp

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: gkw, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack without symbols
x = ParallelArray([1942], function() {})
x + watch.call(x, "length", (function() {}));

asserts js debug shell on m-c changeset 9cd9aae255b5 with --baseline-eager at Assertion failure: (!property.isOwnProperty(constraints())), at jit/IonBuilder.cpp

Tested with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1383872900/jsshell-mac64.zip

which I presume is a 64-bit debug non-deterministic threadsafe build.
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
user:        Brian Hackett
date:        Thu Nov 07 11:12:15 2013 -0800
summary:     Bug 935324 - Clean up adding of type properties to objects, r=jandem.

This iteration took 431.904 seconds to run.
Brian, is bug 935324 a possible regressor?
Blocks: 935324
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
The logic for isOwnProperty() went out of phase with the version of it inlined into IonBuilder::objectsHaveCommonPrototype.
Assignee: general → bhackett1024
Attachment #829304 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #829304 - Flags: review?(jdemooij) → review+
Component: JavaScript Engine → JavaScript Engine: JIT
https://hg.mozilla.org/mozilla-central/rev/4a248fb47a8e
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Flags: in-testsuite+
Followup to update the test to not require ParallelArray (which only exists on nightly):

https://hg.mozilla.org/integration/mozilla-inbound/rev/76a902df4302
You need to log in before you can comment on or make changes to this bug.