698581 - "Assertion failure: obj->isExtensible(),"

Status: RESOLVED DUPLICATE of bug 686296

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = (new Uint8ClampedArray).buffer
b = {}.__proto__
for (var i = 0; i < 2; i++) {
    props = Object.getOwnPropertyNames(b)
    prop = props[props.length - 1] + "p"
    b[prop] = a
}
for each(y in []) {
    y.__proto__ = function() {};
    Object.seal(y)
}

asserts js debug shell on m-c changeset 6cd262091470 with -m at Assertion failure: obj->isExtensible(),

Related to bug 686296 ?

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   71625:b4f74f6e8396
user:        Nikhil Marathe
date:        Wed Jun 29 17:41:35 2011 -0700
summary:     Bug 665355 - Fix __proto__ recursion. r=mrbkap

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 686296).