596821 - "Assertion failure: last < limit && last != slot,"

Status: RESOLVED DUPLICATE of bug 595230

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function g(code) {
  f = eval("(function(){" + code + "})")
  try {
    f()
  } catch(r) {}
}
g("__proto__=Proxy.createFunction((function(){return{n:function(){('')}}}),Array)")
g("*::*")
eval("*")

asserts js debug shell on TM changeset a409054e1395 without -m nor -j at Assertion failure: last < limit && last != slot,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   53414:b1facf8ba54e
user:        Brendan Eich
date:        Thu Sep 02 14:50:44 2010 -0700
summary:     Eliminate JSObject::freeslot via monotonic lastProp->freeslot (592556, r=jorendorff,dvander).

Comment 2

[Jason Orendorff [:jorendorff]]

This is now fixed:

The first good revision is:
changeset:   53637:cda6465ea42d
user:        Brendan Eich <[e-mail]>
date:        Tue Sep 14 17:08:16 2010 -0700
summary:     Don't recycle class-reserved slots onto a dictionary table's freelist (595230, r=jorendorff).

So, marking this as a duplicate.

(This bug's test case is very similar to the one there, which has landed as a regression test.)

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 595230).