1901410 - Assertion failure: prop.isNativeProperty() && prop.propertyInfo().isDataProperty() && prop.propertyInfo().writable(), at /root/src/js/src/jit/VMFunctions.cpp:2058

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

This bug is flaky and must be executed multiple times in order to trigger the assert.

Checkout commit 15778b8c32f8535624fff2af36fc669e65a9af3 and invoke the js shell as follows:

/root/js-spidermonkey-shell  --fast-warmup  --fuzzing-safe  --gc-zeal=22,98 <testcase>

Actual results:

Assertion failure: prop.isNativeProperty() && prop.propertyInfo().isDataProperty() && prop.propertyInfo().writable(), at /root/src/js/src/jit/VMFunctions.cpp:2058

Comment 1

[Jan de Mooij [:jandem]]

The bug here seems to be that freezing/sealing a (prototype) object does not invalidate the megamorphic set-prop cache by bumping its generation counter.

We need to invalidate this cache because of a JS quirk: attempts to shadow a non-writable property on the proto chain must throw. This probably isn't security sensitive but just a correctness issue - the same thing can be achieved with a defineProperty which is allowed to shadow properties on the proto chain.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1901410 - Invalidate megamorphic set-property cache when freezing prototype objects. r?iain!

Freezing an object will mark all data properties non-writable. These properties
then can't be shadowed anymore so we need to ensure add-property cache entries are
invalidated.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e943519aa384
Invalidate megamorphic set-property cache when freezing prototype objects. r=iain

Comment 4

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/e943519aa384