1064058 - Assertion failure: self->nativeContains(cx, aprop), at vm/Shape.cpp:1113 with setObjectMetadataCallback

Status: RESOLVED DUPLICATE of bug 1157566

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 2255d7d187b2 (run with --no-threads --fuzzing-safe --ion-check-range-analysis):


var otherGlobalSameCompartment = newGlobal("same-compartment");
eval = otherGlobalSameCompartment.eval;
eval("\
setObjectMetadataCallback(setObjectMetadataCallback);\
var statusitems = [];\
x = 30;\
delete x;\
");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/cb3487d8700b
user:        Nicolas B. Pierron
date:        Thu Jul 24 04:30:50 2014 -0700
summary:     Bug 1039607 - Scalar Replacement support dynamic slots. r=h4writer

This iteration took 127.716 seconds to run.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision f578b845c4b8).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/020c6a559e3a
user:        Brian Hackett
date:        Sun May 03 08:14:04 2015 -0700
summary:     Bug 1146597 - Add unboxed arrays for JSOP_NEWARRAY arrays, and shell option for using them, r=jandem.

This iteration took 197.177 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Bug 1157566 is probably a duplicate of this bug, but it has already received some developer attention and is likely more actionable. Marking this bug as a dup of 1157566 instead.