Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
8 years ago
6 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

Attachments

(1 attachment)

(Reporter)

Description

8 years ago
Created attachment 472150 [details]
stack

realEval = eval
f = eval("(function(){for(let x in[\
         __defineGetter__(\"\",function(){})\
         ,__defineGetter__(\"\
         functional\
         \",Math.pow)\
         ]){\
         (__defineSetter__(\"\",function(){}))\
         ()\
         }})")
try {
    f()
} catch (r) {
    delete this.eval
    delete this.Math
    eval = realEval
    e = this.toSource
}
f = eval("(function(){(__defineSetter__(\"\
         functional\
         \",(function(){return{t:function(){}}})))()})")
try {
    f()
} catch (r) {
    eval()
}


asserts js debug shell on TM changeset 60af58b42567 without -m nor -j at Assertion failure: !p, (pass the testcase in as a CLI argument to reproduce)
(Reporter)

Updated

8 years ago
blocking2.0: --- → ?
(Reporter)

Comment 1

8 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   52709:cb719643afc5
user:        Brendan Eich
date:        Wed Aug 18 11:34:13 2010 -0700
summary:     Bug 535629 - Deleted properties' slots are not recycled (r=gal).
Blocks: 535629
OS: Linux → All
Hardware: x86 → All

Updated

8 years ago
blocking2.0: ? → betaN+

Comment 2

8 years ago
I'm able to repro on the original cset, but not on TM tip.
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → WORKSFORME
(Reporter)

Comment 3

8 years ago
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   53415:3feb012b18a3
user:        Brendan Eich
date:        Thu Sep 02 18:46:11 2010 -0700
summary:     Bugs in dictionary-mode property table maintenance (593256, r=jorendorff).
Resolution: WORKSFORME → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.