Assertion failure: canRemoveLastProperty(), at jsobjinlines.h:284

RESOLVED DUPLICATE of bug 767961

Status

()

--
critical
RESOLVED DUPLICATE of bug 767961
6 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:t] [jsbugmon:])

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision e9bf05c14376 (options -m -n):


eval("var EXP_1 = new MyValuelessObject(new String('string'));") 
function MyValuelessObject(value) {
  this.toString = this.extends(this.__proto__ = null);
}
Whiteboard: js-triage-needed [jsbugmon:update] → [js:t][jsbugmon:update]
(Reporter)

Updated

6 years ago
Whiteboard: [js:t][jsbugmon:update] → [js:t][jsbugmon:update,bisect]
(Reporter)

Updated

6 years ago
Whiteboard: [js:t][jsbugmon:update,bisect] → [js:t] [jsbugmon:update]
(Reporter)

Comment 1

6 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   83898:78d17e22a223
parent:      83892:0ac1cbff2a67
user:        Brian Hackett
date:        Thu Jan 05 11:08:38 2012 -0800
summary:     Remove JOF_CALLOP, bug 712714. r=dvander
(Reporter)

Comment 2

6 years ago
bhackett, mind taking a look here? (if this bug is important enough of course).
(Reporter)

Updated

6 years ago
Whiteboard: [js:t] [jsbugmon:update] → [js:t] [jsbugmon:update,ignore]
(Reporter)

Comment 3

6 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4d59eb5ac2c6).
(Reporter)

Updated

6 years ago
Whiteboard: [js:t] [jsbugmon:update,ignore] → [js:t] [jsbugmon:bisectfix]
(Reporter)

Updated

6 years ago
Whiteboard: [js:t] [jsbugmon:bisectfix] → [js:t] [jsbugmon:]
(Reporter)

Comment 4

6 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   102961:b21f4cb16f08
user:        Shu-yu Guo
date:        Tue Aug 21 12:29:47 2012 -0700
summary:     Bug 767961 - Only mark properties as definite if we could analyze the entire constructor (r=bhackett)
(Reporter)

Comment 5

6 years ago
Likely the same issue as in bug 767961, marking s-s and duping.
Group: core-security
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 767961
Group: core-security
You need to log in before you can comment on or make changes to this bug.