907147 - Assertion failure: type->proto->hasNewType(&JSObject::class_, type), at jsobj.cpp:1423

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision b7f636fada9f (run with --fuzzing-safe --ion-eager), built with rooting analysis enabled:


gczeal(6);
function f(x) {}
function jQuery(a, c) {}
jQuery.fn = {};
var e = "x";
for (var i = 0; i < e.length; f++) {
    new function() {
        var o = e[i];
        jQuery.fn[o] = function(f) {}
    };
}

Comment 1

[Jon Coppeard (:jonco)]

Attachment: bug907147-rootingAssertion

Patch as erroneously posted originally to 907135.  Carrying review from there.

Comment 2

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/daaee7df86ae

Comment 3

[Ed Morley [:emorley]]

Backed out for assertions:
https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=daaee7df86ae

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/b7fbfd4de77c

When this relands, please can the commit message be relating to the fix, rather than the problem it's fixing? (preferred practice for commits & also in this case, causes false positives on 'Assertion Failure:' in the parser, due to the way buildbot dumps the commit message in the stdout log):-)

Comment 4

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ac03253df279

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ac03253df279