1461167 - Assertion failure: obj->isExtensible() (Can't add new property to non-extensible object), at js/src/vm/Shape.cpp:885

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision a7461494a7a0 (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

See attachment.

Backtrace:

#0  0x00005580f9c4cd07 in js::NativeObject::putDataProperty (cx=<optimized out>, cx@entry=0x7fde4d217000, obj=obj@entry=..., id=id@entry=..., attrs=5) at js/src/vm/Shape.cpp:884
#1  0x00005580f9beb267 in AddOrChangeProperty<(IsAddOrChange)1> (desc=..., id=..., obj=..., cx=0x7fde4d217000) at js/src/vm/NativeObject.cpp:1448
#2  js::NativeDefineProperty (cx=<optimized out>, cx@entry=0x7fde4d217000, obj=..., id=id@entry=..., desc_=..., result=...) at js/src/vm/NativeObject.cpp:1874
#3  0x00005580f9b8174e in js::DefineProperty (cx=cx@entry=0x7fde4d217000, obj=..., id=..., desc=..., result=...) at js/src/vm/JSObject.cpp:2823
#4  0x00005580f9b8179b in js::DefineProperty (cx=0x7fde4d217000, obj=..., id=id@entry=..., desc=..., desc@entry=...) at js/src/vm/JSObject.cpp:2812
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b46f3ba0c766
user:        Jan de Mooij
date:        Sat May 12 11:46:51 2018 +0200
summary:     Bug 1460381 - Support sealed and non-extensible dense elements on native objects. r=anba

Jan, is bug 1460381 a likely regressor?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The testcase wasn't as small as I'd like but it was already getting harder to reproduce as it became smaller.

Comment 5

[Jan de Mooij [:jandem]]

Follow-up patch for bug 1460381 should fix this; hopefully that will merge to m-c soon. Sorry :/