957004 - Assertion failure: !hasLazyType(), at vm/ObjectImpl.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Array.prototype.push(0);
Array.prototype.indexOf()

asserts js debug shell on m-c changeset ce917d3dd7c8 with --no-baseline --no-ion at Assertion failure: !hasLazyType(), at vm/ObjectImpl.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7b039ed2dbac
user:        Till Schneidereit
date:        Fri Nov 29 17:54:36 2013 +0100
summary:     Bug 911578 - Use self-hosting intrinsic isPackedArray to optimize loops in array extras. r=jandem

Till, is bug 911578 a likely regressor?

Comment 1

[Till Schneidereit [:till]]

Attachment: Guard against object being lazily typed in IsPackedArray self-hosting intrinsic.

And another bug I dragged my feet on way to long. :(

Jandem, this is *very* straight-foward. Biggest question is if it's ok to land the test, too. Should obviously land on Aurora at the same time as on m-c, so if you don't give me an r+ over the day, please request uplift and then set checkin-needed. Thanks and sorry!

Comment 2

[Till Schneidereit [:till]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/3f90a1832ac4

Thanks for the quick review!

Comment 3

[Till Schneidereit [:till]]

Comment on attachment 8383535 [details] [diff] [review]
Guard against object being lazily typed in IsPackedArray self-hosting intrinsic.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 911578
User impact if declined: potentially increased crash rate
Testing completed (on m-c, etc.): manual testing and verification, just landed on m-i.
Risk to taking this patch (and alternatives if risky): extremely low, skips an optimization if it's invalid, by checking a flag.
String or IDL/UUID changes made by this patch: none

Comment 4

[Till Schneidereit [:till]]

Comment on attachment 8383535 [details] [diff] [review]
Guard against object being lazily typed in IsPackedArray self-hosting intrinsic.

[Approval Request Comment]
See explanation in Aurora request - I didn't see that this landed in the 28 time frame.

Comment 5

[Sylvestre Ledru [:Sylvestre]]

We are waiting for the landing of the patch in m-c to approve the uplifts.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3f90a1832ac4

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/ad4ef4dfec3f
https://hg.mozilla.org/releases/mozilla-beta/rev/da5745cc5980

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g28_v1_3/rev/da5745cc5980