"Assertion failure: !(*attrsp & (0x10 | 0x20)),"

VERIFIED FIXED in Firefox 17

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla18
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox15 unaffected, firefox16 unaffected, firefox17 fixed, firefox18 fixed, firefox-esr10 unaffected)

Details

(Whiteboard: [jsbugmon:update][qa?][adv-track-main17-])

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 658918 [details]
stack

ParallelArray().watch("shape", function() {})

asserts js debug shell on m-c changeset 5d63594c05a9 without any CLI arguments at Assertion failure: !(*attrsp & (0x10 | 0x20)),

ParallelArray has been responsible for some s-s bugs in the past, so locking this s-s just to be safe.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   102665:ea2ad8970f3e
user:        Shu-yu Guo
date:        Fri Aug 17 10:38:59 2012 -0700
summary:     Bug 778559 - Implement ParallelArray API with sequential execution (r=dmandelin)
(Assignee)

Comment 1

6 years ago
Created attachment 658941 [details] [diff] [review]
fix

Didn't realize JSPROP_READONLY is mutually exclusive with (JSPROP_GETTER | JSPROP_SETTER)
Assignee: general → shu
Attachment #658941 - Flags: review?(dvander)
Attachment #658941 - Flags: review?(dvander) → review+
(Reporter)

Updated

6 years ago
tracking-firefox17: --- → ?
tracking-firefox18: --- → ?
(Assignee)

Comment 2

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/e8ab64043279
tracking-firefox17: ? → ---
tracking-firefox18: ? → ---
https://hg.mozilla.org/mozilla-central/rev/e8ab64043279
Status: NEW → RESOLVED
Last Resolved: 6 years ago
status-firefox18: affected → fixed
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
(Assignee)

Comment 5

6 years ago
Comment on attachment 658941 [details] [diff] [review]
fix


[Approval Request Comment]
Bug caused by (feature/regressing bug #): 778559
User impact if declined: wrong attributes and possible crash
Testing completed (on m-c, etc.): locally and on m-c
Risk to taking this patch (and alternatives if risky): None, localized to a non-publicized and unused-in-the-wild API
String or UUID changes made by this patch:
Attachment #658941 - Flags: approval-mozilla-aurora?

Updated

6 years ago
Attachment #658941 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+

Updated

6 years ago
status-firefox17: affected → fixed
Keywords: verifyme
Does this need verification given comment 4?
Keywords: verifyme
Whiteboard: [jsbugmon:update] → [jsbugmon:update][qa?]
Whiteboard: [jsbugmon:update][qa?] → [jsbugmon:update][qa?][adv-track-main17-]
Group: core-security
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.