Closed Bug 957004 Opened 6 years ago Closed 6 years ago
Assertion failure: !has
Lazy Type(), at vm/Object Impl .h
Array.prototype.push(0); Array.prototype.indexOf() asserts js debug shell on m-c changeset ce917d3dd7c8 with --no-baseline --no-ion at Assertion failure: !hasLazyType(), at vm/ObjectImpl.h My configure flags are: CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options> autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/7b039ed2dbac user: Till Schneidereit date: Fri Nov 29 17:54:36 2013 +0100 summary: Bug 911578 - Use self-hosting intrinsic isPackedArray to optimize loops in array extras. r=jandem Till, is bug 911578 a likely regressor?
And another bug I dragged my feet on way to long. :( Jandem, this is *very* straight-foward. Biggest question is if it's ok to land the test, too. Should obviously land on Aurora at the same time as on m-c, so if you don't give me an r+ over the day, please request uplift and then set checkin-needed. Thanks and sorry!
Attachment #8383535 - Flags: review?(jdemooij)
Assignee: nobody → till
Status: NEW → ASSIGNED
Attachment #8383535 - Flags: review?(jdemooij) → review+
remote: https://hg.mozilla.org/integration/mozilla-inbound/rev/3f90a1832ac4 Thanks for the quick review!
Comment on attachment 8383535 [details] [diff] [review] Guard against object being lazily typed in IsPackedArray self-hosting intrinsic. [Approval Request Comment] Bug caused by (feature/regressing bug #): 911578 User impact if declined: potentially increased crash rate Testing completed (on m-c, etc.): manual testing and verification, just landed on m-i. Risk to taking this patch (and alternatives if risky): extremely low, skips an optimization if it's invalid, by checking a flag. String or IDL/UUID changes made by this patch: none
Comment on attachment 8383535 [details] [diff] [review] Guard against object being lazily typed in IsPackedArray self-hosting intrinsic. [Approval Request Comment] See explanation in Aurora request - I didn't see that this landed in the 28 time frame.
We are waiting for the landing of the patch in m-c to approve the uplifts.
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.