1148874 - Assertion failure: vp.toString()->isAtom(), at js/src/jit/MIR.cpp:713

Status: RESOLVED DUPLICATE of bug 1148883

(Core :: JavaScript Engine, defect)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I can reliably reproduce:
Assertion failure: vp.toString()->isAtom(), at js/src/jit/MIR.cpp:713
by loading the page:
http://www.economist.com/blogs/freeexchange/2015/03/wealth-inequality?fsrc=scn%2Ftw%2Fte%2Fbl%2Fed%2Fnimbysinthetwentyfirstcentury

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(This is in a Linux x86_64 debug build based off of mozilla-central from earlier today.)

Comment 2

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: brief gdb session

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Assertion added in https://hg.mozilla.org/mozilla-central/rev/d4cac14b98af , landed yesterday.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Also fires on http://www.womenon20s.org/

Comment 5

[Andrew McCreight [:mccr8]]

I also get this on http://techcrunch.com/

Comment 6

[Andrew McCreight [:mccr8]]

The patch in bug 1148883 fixes the TechCrunch assertion for me.

Comment 7

[Nicolas B. Pierron [:nbp]]

(In reply to David Baron [:dbaron] ⏰UTC-7 from comment #2)
> Created attachment 8585129 [details]
> brief gdb session

Thanks for the stack trace :)
This looks like the same code path as the one fixed in Bug 1148883.