If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40), at vm/Shape.cpp:752

RESOLVED FIXED in mozilla25

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla25
x86_64
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox24 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments, 1 obsolete attachment)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision 1eb382609c2d (run with --ion-eager):


this.__defineSetter__("customNative", unescape);
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 1

4 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   125296:f7e1b97dcc73
user:        Jan de Mooij
date:        Mon Mar 18 22:34:34 2013 +0100
summary:     Bug 851109 - Add NAME IC for invoking getters on the global object. r=djvj

This iteration took 139.998 seconds to run.
(Reporter)

Comment 2

4 years ago
Jandem, can you take a look based on comment 1? :)
(Reporter)

Comment 3

4 years ago
Created attachment 747260 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 4

4 years ago
Created attachment 747279 [details]
[crash-signature] Machine-readable crash signature
Attachment #747260 - Attachment is obsolete: true
Flags: needinfo?(jdemooij)
Blocks: 851109
Keywords: regression
(Assignee)

Comment 5

4 years ago
Created attachment 774542 [details] [diff] [review]
Patch

I added a customNative property to the shell's global, but this asserts if we don't pass the JSPROP_SHARED flag to JS_DefineProperty.

Only affects the shell.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #774542 - Flags: review?(jwalden+bmo)
Flags: needinfo?(jdemooij)
Attachment #774542 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Comment 6

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/8a658a424d35
https://hg.mozilla.org/mozilla-central/rev/8a658a424d35
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
(Reporter)

Updated

4 years ago
status-firefox24: --- → affected
You need to log in before you can comment on or make changes to this bug.