862699 - Assertion failure: isNative(), at vm/ObjectImpl.cpp with bug 804676 fixes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

eval("\
    Object.defineProperty(this,\"y\",{\
        get: function(){ x[\"\"] }}\
    );\
    x = Int32Array();\
    this.h, y\
",newGlobal())

asserts js debug and opt shell on ionmonkey (where bug 804676 fixes landed for testing) changeset d746d516bf55 with --ion-eager and -a at Assertion failure: isNative(), at vm/ObjectImpl.cpp

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   128515:75ff34ead9fc
user:        Brian Hackett
date:        Mon Apr 15 05:16:23 2013 -0600
summary:     Bug 861439 - Add type barriers when reading from undefined properties of singleton objects.

Comment 2

[Brian Hackett [Laid off!]]

Fixed by the patch in bug 862708.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ae6a2cf914f7