673788 - TI: "Assertion failure: !cx->compartment->activeAnalysis,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

p = Proxy.create({
  has: function() {}
})
Object.prototype.__proto__ = p
n = [];
(function() {
  var a = [];
  if (b) t = a.s()
})()

asserts js debug shell on JM changeset 8c7adf094b8e with -m, -a and -n at Assertion failure: !cx->compartment->activeAnalysis,

This was found using a triple combination of an existing js test, jsfunfuzz and jandem's method fuzzer.

Comment 1

[Brian Hackett [Laid off!]]

When the compiler is testing to see if it can nop a property access on a singleton JS object (the JS object already has the property and is fetching a specific value for the result), it checked the object for a lookupProperty hook but not the object's prototype chain.  This caused the resulting lookup on the singleton to call the proxy method while the compiler was still running.

http://hg.mozilla.org/projects/jaegermonkey/rev/60cb5a22dc10

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug673788.js.