639412 - TM/JM: "Assertion failure: v_ins->isD(),"

Status: RESOLVED DUPLICATE of bug 639343

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

{
    __proto__.__defineSetter__("", function() {})
    __proto__.p = function() {}
    __proto__.watch("e", function() {})
    __proto__[0] = 3
}
(function() {
    for each(e in [0, 0, 0, 0, 0, 0]) {
        print(Uint8ClampedArray()[0])
    }
})()

asserts js debug shell on TM changeset 1c8e91b2e3a4 with -m, -j and -a at Assertion failure: v_ins->isD()

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Array.prototype.__proto__[0]=8.3
eval("\
  for(a = 0; a < 9; a++) {\
    print(new Int32Array()[0]);\
  }\
");

is a testcase that asserts similarly and only requires -j.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   51690:c497469955fa
user:        Vladimir Vukicevic
date:        Fri Aug 27 12:06:34 2010 -0400
summary:     b=590672; treat ArrayBuffer() and SomeArrayType() as (0); r=shaver