980119 - Assertion failure: !unknownProperties(), at jsinfer.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

s = newGlobal()
evalcx("\
    x = new Uint8ClampedArray;\
    x.__proto__ = [];\
", s);
evalcx("\
    x[0]\
", s);


asserts js debug shell on m-c changeset 714c8927d6af with --ion-eager at Assertion failure: !unknownProperties(), at jsinfer.cpp

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --disable-threadsafe

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140304112656" and the hash "703bd71926e4".
The "bad" changeset has the timestamp "20140304114257" and the hash "78fa90a29c43".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=703bd71926e4&tochange=78fa90a29c43


Only bug 695438 is in that list, bhackett, is it a likely regressor?

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/288cea1386a4

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/288cea1386a4