914127 - Assertion failure: IsCallPC(pc), at jit/IonFrames.cpp:1475

Status: RESOLVED DUPLICATE of bug 913978

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe --ion-eager):


index = 0;
for (j = 0; j <= 1; ++j) 
  def({get: Function("return "+index+";")});
function def(descriptor_seed) {
  var var_name = "x" + index;
  descriptor_seed.enumerable = !!j;
  Object.defineProperty(Object.prototype, var_name, descriptor_seed);
  ++index;
}
function testDontEnum(F) {
  var proto = F.prototype;
  for (var prop in F)
    if (F[prop] === proto)
      return false;
}
testDontEnum(Error);
testDontEnum(URIError);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Related to bug 913978?

Comment 3

[Kannan Vijayan [:djvj]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)
> Related to bug 913978?

Yeah, dup.