Closed Bug 1301193 Opened 4 years ago Closed 4 years ago

Assertion failure: shape->isDataDescriptor(), at js/src/vm/Interpreter.cpp:4399

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1300521
Tracking Status
firefox51 --- affected

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, jsbugmon, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 33e7ae9b3104 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

s = newGlobal();
evalcx("Object.defineProperty(this, 'f', { set: function() {} });", s);
evalcx("var f; function f(){};", s);


Backtrace:

0   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc49e00 js::DefFunOperation(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::Handle<JSFunction*>) + 2560 (Interpreter.cpp:4399)
1   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc3ea31 Interpret(JSContext*, js::RunState&) + 53249 (RootingAPI.h:717)
2   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc31964 js::RunScript(JSContext*, js::RunState&) + 484 (Interpreter.cpp:400)
3   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc45932 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) + 1106 (Interpreter.cpp:681)
4   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc45f3e js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) + 830 (RootingAPI.h:706)
/snip

For detailed crash information, see attachment.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/701075b5e63c
user:        Shu-yu Guo
date:        Fri Sep 02 15:30:48 2016 -0700
summary:     Bug 1298640 - Track top-level functions in eval/global bodies for all-or-nothing redeclaration checks. (r=Waldo)

Shu-yu, is bug 1298640 a likely regressor?
Blocks: 1298640
Flags: needinfo?(shu)
This might be related to bug 1300521.
Status: NEW → RESOLVED
Closed: 4 years ago
Flags: needinfo?(shu)
Resolution: --- → DUPLICATE
Duplicate of bug: 1300521
You need to log in before you can comment on or make changes to this bug.