888896 - Assertion failure: obj->lastProperty() == p->value.shape, at js/src/jsinfer.cpp:3327 with setObjectMetadataCallback

Status: RESOLVED DUPLICATE of bug 893890

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision d7553251cf43 (run with --fuzzing-safe --ion-eager):


incallback = false;
function callback(obj) {
    if (incallback)
        return null;
    incallback = true;
    var res = {};
    incallback = false;
    return res;
}
callback();
setObjectMetadataCallback(callback);
evaluate("test({y:{}}); test({y:{}});");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/be1399f8f973
user:        Brian Hackett
date:        Thu May 30 17:37:22 2013 -0600
summary:     Bug 850026 - Allow metadata objects to be associated with JS objects, and add a hook for attaching metadata to newly created objects, r=luke.

This iteration took 1.955 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 2.