1301193 - Assertion failure: shape->isDataDescriptor(), at js/src/vm/Interpreter.cpp:4399

Status: RESOLVED DUPLICATE of bug 1300521

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 33e7ae9b3104 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

s = newGlobal();
evalcx("Object.defineProperty(this, 'f', { set: function() {} });", s);
evalcx("var f; function f(){};", s);


Backtrace:

0   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc49e00 js::DefFunOperation(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::Handle<JSFunction*>) + 2560 (Interpreter.cpp:4399)
1   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc3ea31 Interpret(JSContext*, js::RunState&) + 53249 (RootingAPI.h:717)
2   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc31964 js::RunScript(JSContext*, js::RunState&) + 484 (Interpreter.cpp:400)
3   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc45932 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) + 1106 (Interpreter.cpp:681)
4   js-dbg-64-dm-clang-darwin-33e7ae9b3104	0x000000010cc45f3e js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) + 830 (RootingAPI.h:706)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/701075b5e63c
user:        Shu-yu Guo
date:        Fri Sep 02 15:30:48 2016 -0700
summary:     Bug 1298640 - Track top-level functions in eval/global bodies for all-or-nothing redeclaration checks. (r=Waldo)

Shu-yu, is bug 1298640 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This might be related to bug 1300521.