906242 - GenerationalGC: Crash [@ js::ion::GetPropertyIC::UpdateInfo]

Status: RESOLVED DUPLICATE of bug 906236

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    (2, {})
} catch (e) {}
try {
    (function() {
        Object.defineProperty(this, "v1", {
            get: function() {
                Object.e({
                    l: false,
                    o: true,
                    l: (Object(({
                        s: ((function f(vsollj) {
                            print
                            f(vsollj)
                            const d = eval(""), w = ((("")))
                        })(2))
                    }))),
                    n: e,
                    n: f
                })
            }
        })
    })
    ()
    (v1)
    (function() {
        ({})
    })
} catch (e) {}

crashes js debug shell (tested with a threadsafe 64-bit debug build) on m-i changeset a63f47fcbe98 without any CLI arguments at js::ion::GetPropertyIC::UpdateInfo

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   140539:1a0e01422cb3
user:        Terrence Cole
date:        Wed Jul 10 10:13:46 2013 -0700
summary:     Bug 889682 - Eagerly check for remembered set membership before buffering; r=billm

Comment 1

[Jon Coppeard (:jonco)]

This is the same issue as bug 906236. 

I've verified that the patch posted there fixes this issue too.