867082 - Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40), at vm/Shape.cpp:752

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1eb382609c2d (run with --ion-eager):


this.__defineSetter__("customNative", unescape);

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   125296:f7e1b97dcc73
user:        Jan de Mooij
date:        Mon Mar 18 22:34:34 2013 +0100
summary:     Bug 851109 - Add NAME IC for invoking getters on the global object. r=djvj

This iteration took 139.998 seconds to run.

Comment 2

[Christian Holler (:decoder)]

Jandem, can you take a look based on comment 1? :)

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Patch

I added a customNative property to the shell's global, but this asserts if we don't pass the JSPROP_SHARED flag to JS_DefineProperty.

Only affects the shell.

Comment 6

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a658a424d35

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8a658a424d35