897492 - Assertion failure: js_CodeSpec[*pc_].format & (1U<<21), at ion/IonFrames.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Stack of top 50 lines with no symbols :(

try {
    Object.defineProperty(this, "x", {
        get: function() {
            return this.x
        }
    })(x, {})
} catch (e) {}
x[6] = 2

asserts js debug shell on m-c changeset b3fcd828cadc without any CLI arguments at Assertion failure: js_CodeSpec[*pc_].format & (1U<<21), at ion/IonFrames.cpp

I reproduced with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1374669401/jsshell-mac64.zip

Regression window:

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9875c9400636&tochange=b3fcd828cadc

Looking at the regression window, this might be related to Eric's patches in bug 765454 or bug 891980.

js::ion::InlineFrameIteratorMaybeGC is on the stack, setting s-s for now.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Eric Faust [:efaust]]

Attachment: Fix bogus assert

This isn't security sensitive at all. It's just a mistaken assert that should have been updated to account for inlined property accessors.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Opening up as per comment 2.

Comment 4

[Eric Faust [:efaust]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/852cd603e5e0

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/852cd603e5e0