1096789 - Assertion failure: obj->isNative(), at vm/NativeObject.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = wrap({});
Proxy.create(Object, x)
Array.prototype.shift.call(x)

asserts js debug shell on m-c changeset cbe6afcae26c with --no-ion --no-threads at Assertion failure: obj->isNative(), at vm/NativeObject.cpp.

Debug configure options:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/fd58d09bcf1c
user:        Jason Orendorff
date:        Sat Oct 18 16:49:50 2014 -0500
summary:     Bug 1090537, part 8 - In SetPropertyHelper, if defining a new data property, define it on receiver, not obj. r=efaust.

Jason, is bug 1090537 a possible regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0xbf7dc, 0x006ceafb js-dbg-opt-32-dm-nsprBuild-darwin-cbe6afcae26c`PurgeScopeChain(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>) [inlined] JSObject::lastProperty(this=<unavailable>, this=<unavailable>, flag=<unavailable>) const + 15 at jsobj.h:129, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x006ceafb js-dbg-opt-32-dm-nsprBuild-darwin-cbe6afcae26c`PurgeScopeChain(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>) [inlined] JSObject::lastProperty(this=<unavailable>, this=<unavailable>, flag=<unavailable>) const + 15 at jsobj.h:129
    frame #1: 0x006ceaec js-dbg-opt-32-dm-nsprBuild-darwin-cbe6afcae26c`PurgeScopeChain(js::ExclusiveContext*, JS::Handle<JSObject*>, JS::Handle<jsid>) [inlined] JS::Handle<JSObject*>::operator->(this=<unavailable>) const at jsobj.h:216
    frame #2: 0x006ceaec js-dbg-opt-32-dm-nsprBuild-darwin-cbe6afcae26c`PurgeScopeChain(cx=<unavailable>, obj=<unavailable>, id=<unavailable>) + 380 at NativeObject.cpp:1392
    frame #3: 0x006d16a6 js-dbg-opt-32-dm-nsprBuild-darwin-cbe6afcae26c`bool SetPropertyByDefining<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, bool) [inlined] js::BarrieredBase<js::types::TypeObject*>::operator->(this=<unavailable>) const + 134 at jsinfer.h:1061
    frame #4: 0x006d1692 js-dbg-opt-32-dm-nsprBuild-darwin-cbe6afcae26c`bool SetPropertyByDefining<(js::ExecutionMode)0>(js::ExecutionModeTraits<(js::ExecutionMode)0>::ContextType, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, bool) [inlined] JS::Handle<JSObject*>::operator->(this=<unavailable>) const + 2 at jsobj.h:138
(lldb)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I think 64-bit shells are also affected.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision cf9eafef4ffa).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/430b12e87f20
user:        Jason Orendorff
date:        Mon Nov 10 16:53:04 2014 -0600
summary:     Bug 1095973 - Fix crash @PurgeProtoChain introduced by 1090537. r=efaust.

Is bug 1095973 a likely fix? If so, is the testcase in comment 0 still needed?

Comment 5

[Jason Orendorff [:jorendorff]]

Yes, bug 1095973 is definitely the fix. I think the testcase would be a fine addition.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jason Orendorff [:jorendorff] from comment #5)
> Yes, bug 1095973 is definitely the fix. I think the testcase would be a fine
> addition.

Fixed by bug 1095973, then. Setting in-testsuite? for landing of the testcase.