618575 - "Assertion failure: &pobj->getSlot(shape->slot).toObject() == &shape->methodObject(),"

Status: RESOLVED DUPLICATE of bug 561359

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function () {
  (eval("\
    (function(){\
      for(let y in[0,0]){\
        (b=Proxy.createFunction((function(){\
          return{get:function(){}}\
        })(<x/>),function(){<x/>}))}})\
"))()
})();
(eval("(function(){for(let b=(b.(d))in x){}})"))()

asserts js debug shell on TM changeset 1002cba2f2d6 without -m or -j at Assertion failure: &pobj->getSlot(shape->slot).toObject() == &shape->methodObject(),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   52720:66c8ad02543b
user:        Luke Wagner
date:        Mon Aug 16 12:35:04 2010 -0700
summary:     Bug 581263 - remove slow natives (r=waldo,mrbkap)

Comment 2

[Luke Wagner [:luke]]

Although it hits on slow native removal, applying the fixing-the-bug-but-not-the-right-fix patch from bug 561359 makes the assertion go away.

Jason: I don't know, but this might be a useful test case to add in addition to the one in bug 561359.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 561359).