950456 - Assertion failure: [infer failure] Missing type in object [0x7f68c2d39858] value: [0x7f68c2d39698], at jsinfer.cpp:285 with Map

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c049cb230d77 (run with --fuzzing-safe):


gczeal(2,1);
gcPreserveCode()
__defineGetter__('eval', 
    function() { 
        Map([['a', 'b'], ['b', 'c']]) === (Array(10)).length;
    });
eval;
try { eval(); } catch(exc1) {}
try { eval(); } catch(exc1) {}
try { eval(); } catch(exc1) {}
try { eval(); } catch(exc1) {}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Possibly related to bug 950460.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/2e5ff5614254
user:        Brian Hackett
date:        Thu Dec 12 13:10:54 2013 -0800
summary:     Bug 932982 - Trace type constraints and allow preserving jitcode in GCs without also marking all type information, r=billm, r=jandem

This iteration took 338.826 seconds to run.

Comment 4

[Jan de Mooij [:jandem]]

Setting needinfo based on comment 3.

Comment 5

[Brian Hackett [Laid off!]]

I can't reproduce on 10.8 or Linux.  Decoder, what are your exact configure options?

Comment 6

[Christian Holler (:decoder)]

(In reply to Brian Hackett (:bhackett) from comment #5)
> I can't reproduce on 10.8 or Linux.  Decoder, what are your exact configure
> options?

I used --disable-threadsafe --enable-debug --enable-optimize --enable-valgrind with a 64 bit build.

Comment 7

[Brian Hackett [Laid off!]]

Attachment: patch

This is a preexisting baseline tracing issue that was exposed by bug 932982.  Monitor and update stubs weren't being properly traced.

Comment 8

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c3e2e933e48

Comment 9

[Brian Hackett [Laid off!]]

(In reply to Brian Hackett (:bhackett) from comment #7)
> This is a preexisting baseline tracing issue that was exposed by bug 932982.
> Monitor and update stubs weren't being properly traced.

To clarify, there wasn't any way to trigger this bug before bug 932982 landed.  (Before bug 932982, whenever we preserved the baseline jitcode for a script we also marked all singleton objects and type objects in the compartment, which are the only things marked by update/monitor type stubs).

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/5c3e2e933e48

Comment 11

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Can we go ahead and land the test since this is trunk-only?