914098 - Assertion failure: !unknownObject(), at jsinferinlines.h:1378

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe):


function ygTreeView(id) {};
function ygNode() {}
ygNode.prototype.init = function () {
    this.children = [];
}
ygTextNode.prototype = new ygNode;
function ygTextNode() {
    this.init(it.next.bind(it), StopIteration)
}
userTree = new ygTreeView("userTree")
addMenuNode(userTree)
function addMenuNode(tree) {
    new ygTextNode({}, tree.root, false)
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Carsten Book [:Tomcat]]

seems this also happens in realworld sites since bughunter was also discovering sites with this assertion

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/abb25a18b5a5
user:        Brian Hackett
date:        Mon Sep 02 10:05:27 2013 -0700
summary:     Bug 906788 - Construct TypeObject newScript information using MIR, r=jandem.

This iteration took 339.772 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 3 :)

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b713e1beae22

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b713e1beae22

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: stack of hitting this on google map maker

I hit this crash on a link from email from Google Map Maker.

2b26501fd203 (i.e., without the fix)

Comment 9

[Brian Hackett [Laid off!]]

(In reply to David Baron [:dbaron] (needinfo? me) (busy through Sept. 14) from comment #8)
> Created attachment 803767 [details]
> stack of hitting this on google map maker
> 
> I hit this crash on a link from email from Google Map Maker.
> 
> 2b26501fd203 (i.e., without the fix)

I think the patch should fix this crash.