936361 - Assertion failure: (!property.isOwnProperty(constraints())), at jit/IonBuilder.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack without symbols

x = ParallelArray([1942], function() {})
x + watch.call(x, "length", (function() {}));

asserts js debug shell on m-c changeset 9cd9aae255b5 with --baseline-eager at Assertion failure: (!property.isOwnProperty(constraints())), at jit/IonBuilder.cpp

Tested with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1383872900/jsshell-mac64.zip

which I presume is a 64-bit debug non-deterministic threadsafe build.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
user:        Brian Hackett
date:        Thu Nov 07 11:12:15 2013 -0800
summary:     Bug 935324 - Clean up adding of type properties to objects, r=jandem.

This iteration took 431.904 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 935324 a possible regressor?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

The logic for isOwnProperty() went out of phase with the version of it inlined into IonBuilder::objectsHaveCommonPrototype.

Comment 4

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4a248fb47a8e

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4a248fb47a8e

Comment 6

[Brian Hackett [Laid off!]]

Followup to update the test to not require ParallelArray (which only exists on nightly):

https://hg.mozilla.org/integration/mozilla-inbound/rev/76a902df4302

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/76a902df4302