1064054 - Assertion failure: name != cx->names().proto (should have used JSOP_MUTATEPROTO), at jit/BaselineIC.cpp:7664

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 2255d7d187b2 (run with --fuzzing-safe --no-threads --ion-eager):


Function("return { __proto__() {} }")();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Fuzzblocker due to frequency.

Comment 3

[Till Schneidereit [:till]]

Pretty sure that's Waldo's

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8acb4009398c
user:        Jeff Walden
date:        Sat Aug 30 14:27:19 2014 -0700
summary:     Bug 1061853 - Reintroduce PNK_MUTATEPROTO to distinguish ({ __proto__: v }) as mutating the [[Prototype]] from ({ __proto__() {} }) as not doing so.  r=shu

This iteration took 359.865 seconds to run.

Comment 5

[Jeff Walden [:Waldo]]

Attachment: Remove now-invalid assertion

JSOP_INITPROP is now used with __proto__ in rare cases, so remove the assertion here.  Also add tests for all the non-prototype-mutating definition flavors that were in the object-literal-__proto__.js test previously landed.

Comment 6

[Jeff Walden [:Waldo]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/206d9ecf4063

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/206d9ecf4063