724784 - IonMonkey: Crash [@ js::PropertyTable::search] or "Assertion failure: table_ && isOwned(),"

Status: RESOLVED DUPLICATE of bug 724788

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = Object.prototype
function f(o) {
    try {
        ({
            x: [eval("o")][0]
        }.x.__defineGetter__("toString", function() {
            e;
        }));
        (function() {} + o)
    } catch (e) {}({} == 1)
}
f(a)

crashes js debug and opt shell on IonMonkey changeset f46cfb199e77 with -m, --ion, --ion-eager and -n at js::PropertyTable::search

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

a = {}
o = String.prototype.__proto__
function f3() {
    try {
        ({
            x: eval("o")
        }.x.__defineGetter__("", function() {
            o
        }))
    } catch (e) {}
    for (x in o) {
        o[x]
    }[function() {
        return o
    }()][0].h = 1
}
for (i = 0; i < 12; i++) {
    f3()
    f3()
}
for (p in a) {
    a[p]
}

is a testcase that crashes opt at the same signature and asserts js debug at Assertion failure: table_ && isOwned(), on IonMonkey changeset 40112ee40593 with --ion, -n and -m.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 724788).