Assertion failure: self->nativeContains(cx, aprop), at vm/Shape.cpp:1113 with setObjectMetadataCallback

RESOLVED DUPLICATE of bug 1157566

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 1157566
3 years ago
2 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(firefox35 affected)

Details

(Whiteboard: [jsbugmon:])

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
The following testcase asserts on mozilla-central revision 2255d7d187b2 (run with --no-threads --fuzzing-safe --ion-check-range-analysis):


var otherGlobalSameCompartment = newGlobal("same-compartment");
eval = otherGlobalSameCompartment.eval;
eval("\
setObjectMetadataCallback(setObjectMetadataCallback);\
var statusitems = [];\
x = 30;\
delete x;\
");
(Reporter)

Comment 1

3 years ago
Created attachment 8485507 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

3 years ago
status-firefox35: --- → affected
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 2

3 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/cb3487d8700b
user:        Nicolas B. Pierron
date:        Thu Jul 24 04:30:50 2014 -0700
summary:     Bug 1039607 - Scalar Replacement support dynamic slots. r=h4writer

This iteration took 127.716 seconds to run.
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 3

3 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision f578b845c4b8).
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 4

3 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/020c6a559e3a
user:        Brian Hackett
date:        Sun May 03 08:14:04 2015 -0700
summary:     Bug 1146597 - Add unboxed arrays for JSOP_NEWARRAY arrays, and shell option for using them, r=jandem.

This iteration took 197.177 seconds to run.
(Reporter)

Comment 5

2 years ago
Bug 1157566 is probably a duplicate of this bug, but it has already received some developer attention and is likely more actionable. Marking this bug as a dup of 1157566 instead.
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1157566
You need to log in before you can comment on or make changes to this bug.