1063182 - Assertion failure: !hasLazyType(), at vm/ObjectImpl.h:603

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 776fa9cf70cd (run with --fuzzing-safe --no-threads --ion-eager):


eval("(function() { " + "\
var o = {};\
o.watch('p', function() { });\
for (var i = 0; i < 10; \u5ede ++)\
    o.p = 123;\
" + " })();");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Filed this one s-s because this assert can actually be security-sensitive, further triage is required to figure that out (just confirmed this on IRC).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a1b25f21fe08
user:        Brian Hackett
date:        Tue Sep 02 13:47:34 2014 -0600
summary:     Bug 1041688 - Add acquired properties analysis, r=jandem.

This iteration took 0.598 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from Brian, based on comment 3 :)

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

This use is OK, actually, as we only use the type when attaching an AddProp stub, in which case we will have made sure the type was instantiated properly beforehand.  This code is pretty complicated though and bending over backwards to avoid instantiating the type here isn't worth it.

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/963cd8abf052

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/963cd8abf052