var x = Object.toString() function z() { if (/x/) {} }; // Randomly chosen test: js/src/tests/ecma/GlobalObject/15.1-1-n.js // -- reduced away -- // Randomly chosen test: js/src/jit-test/tests/basic/testBug756919.js try { eval(` gcparam("maxBytes", gcparam("gcBytes") + 1); function f() { var y = ""; function g() {} f(); eval(); } f(); `) } catch (e) {}; // Randomly chosen test: js/src/jit-test/tests/basic/testMultipleArgumentsObjects.js try { load("a.js"); } catch (e) {} // Randomly chosen test: js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js // -- reduced away -- // Randomly chosen test: js/src/jit-test/tests/closures/incr-exit-3.js // -- reduced away -- and a.js is: function g() { x = arguments; function f(e, which) { var args = [x, arguments] return args[which][0] } m = [0, 0, 1] for (i = 0; i < 3; i++) { m[i] = f("f", m[i]) } return m.toString() } assertEq(g(), ",,f") asserts js debug shell on m-c changeset b17e7747d3fb with --fuzzing-safe --no-threads --no-ion at Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h. Debug configure options: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests This was found by combining random js tests together with jsfunfuzz, the specific file(s) is/are: http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/tests/ecma/GlobalObject/15.1-1-n.js http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/basic/testBug756919.js http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/basic/testMultipleArgumentsObjects.js http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/closures/incr-exit-3.js autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/9605a571ca8a user: Brian Hackett date: Tue Aug 19 22:25:37 2014 -0800 summary: Bug 934450 - Allow objects to have copy on write elements, r=billm,jandem. Brian, not sure if bug 934450 is the actual regressor here. Thoughts?

This also asserts on: https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2014-12-23-mozilla-central-debug/jsshell-mac64.zip

(lldb) bt 5 * thread #1: tid = 0x98eab, 0x00000001006311ce js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::Invoke(cx=<unavailable>, args=<unavailable>, construct=<unavailable>) + 1262 at Interpreter.cpp:471, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0) * frame #0: 0x00000001006311ce js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::Invoke(cx=<unavailable>, args=<unavailable>, construct=<unavailable>) + 1262 at Interpreter.cpp:471 frame #1: 0x000000010064dfe0 js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`Interpret(cx=<unavailable>, state=<unavailable>) + 43632 at Interpreter.cpp:2561 frame #2: 0x0000000100643549 js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::RunScript(cx=0x0000000101b149e0, state=0x00007fff5fbff178) + 345 at Interpreter.cpp:452 frame #3: 0x000000010062c66d js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::ExecuteKernel(cx=0x0000000101b149e0, scopeChainArg=0x0000000101e5d060, thisv=<unavailable>, type=<unavailable>, result=<unavailable>, script=<unavailable>, evalInFrame=<unavailable>) + 925 at Interpreter.cpp:661 frame #4: 0x00000001006562c1 js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::Execute(cx=0x0000000101b149e0, scopeChainArg=<unavailable>, rval=0x0000000000000000, script=<unavailable>) + 433 at Interpreter.cpp:697 (lldb)

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

var x = Object.toString() function z() { if (/x/) {} }; // Randomly chosen test: js/src/tests/ecma/GlobalObject/15.1-1-n.js // -- reduced away -- // Randomly chosen test: js/src/jit-test/tests/basic/testBug756919.js try { eval(` gcparam("maxBytes", gcparam("gcBytes") + 1); function f() { var y = ""; function g() {} f(); eval(); } f(); `) } catch (e) {}; // Randomly chosen test: js/src/jit-test/tests/basic/testMultipleArgumentsObjects.js evaluate(` function g() { x = arguments; function f(e, which) { var args = [x, arguments]; return args[which][0] } m = [0, 0, 1]; for (i = 0; i < 3; i++) { m[i] = f("f", m[i]) } return m.toString() } assertEq(g(), ",,f") `, { compileAndGo: true }) // Randomly chosen test: js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js // -- reduced away -- // Randomly chosen test: js/src/jit-test/tests/closures/incr-exit-3.js // -- reduced away -- asserts js debug shell on m-c changeset b17e7747d3fb with --fuzzing-safe --no-threads --no-ion at Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h. This now has the load function removed. Thanks to :decoder for his help.

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Helped to land this: https://hg.mozilla.org/integration/mozilla-inbound/rev/9878f361d7f7

This might or might not have caused bustage: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux/1419897912/mozilla-inbound-linux-bm70-build1-build580.txt.gz Let's see what we get by backing it out.

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/c139cf2e487d for that bustage.

Over IRC: 16:39 glandium: gkw, KWierso|sheriffduty: fwiw, that build error means that running xpcshell with MOZ_STARTUP_CACHE doesn't work properly 16:39 gkw: glandium: I see. Thanks!

https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=9878f361d7f7 has other failures. Oops.

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #11) > https://treeherder.mozilla.org/#/jobs?repo=mozilla- > inbound&revision=9878f361d7f7 > > has other failures. Oops. More precisely, it broke everything bug Cpp unit tests.

(In reply to Mike Hommey [:glandium] (out from Dec 31 to Jan 5 incl.) from comment #12) > More precisely, it broke everything bug Cpp unit tests. s/everything bug/everything but/

Hmm, getConstantValue would also return false if it wasn't allowed to convert nested objects. This patch fixes this case by returning a magic value in such cases, so the return value is used consistently. https://hg.mozilla.org/integration/mozilla-inbound/rev/60bccc6ddd08