The default bug view has changed. See this FAQ.

"Assertion failure: type_->proto->newType" with proxy freeze

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 557940 [details]
crash report

./js -n

var x = Proxy.create({ fix: function() { return []; } });
Object.__proto__ = x;
Object.freeze(x);
quit();

Triggers this assertion during shell shutdown:
  Assertion failure: type_->proto->newType, at js/src/jsinfer.cpp:5273

This is a regression from bug 669969 (rev dd84f621ca25 + rev cdb452875184).
Created attachment 557997 [details] [diff] [review]
patch

TradeGuts would swap the new types for the two objects, which it shouldn't do, violating an invariant that the prototype of a singleton object has a newType.  newType is cached data inline to the JSObject (the same as emptyShapes before it), not functional information.  Filed bug 684410 to remove newType entirely from JSObject.
Attachment #557997 - Flags: review?(wmccloskey)
Attachment #557997 - Flags: review?(wmccloskey) → review+
http://hg.mozilla.org/projects/jaegermonkey/rev/8385e0145b8d
Whiteboard: fixed-in-jaegermonkey
http://hg.mozilla.org/mozilla-central/rev/8385e0145b8d
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.