935952 - Assertion failure: !unknownProperties(), at c:\work\mozilla\builds\aurora\mozilla\js\src\jsinferinlines.h:1396

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Found via bughunter loading 
https://groups.google.com/forum/?hl=pt-BR#%21forum/fiscais_avancado results in nearly on load:

Assertion failure: !unknownProperties(), at c:\work\mozilla\builds\aurora\mozilla\js\src\jsinferinlines.h:1396

in aurora and nightly at least on linux and windows 

will see if i can bring a testcase etc

Comment 1

[Carsten Book [:Tomcat]]

Jan could you take a look at this (stack is also comming)

Comment 2

[Carsten Book [:Tomcat]]

Attachment: windos stack

Comment 3

[Carsten Book [:Tomcat]]

Attachment: reduced testcase (at least was lithium was able to)

if this does not crash just reload 1 or 2 times

Comment 4

[Jan de Mooij [:jandem]]

Looks like in TypeObjectKey::property, the EnsureTrackPropertyTypes call marks the TypeObject as having unknownProperties and the maybeGetProperty call fails.

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

Clean up the TypeObjectKey::property interface to avoid this issue.  This won't lead to any security problems.

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0fdbc3f4d34e

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0fdbc3f4d34e

Comment 8

[Ada [:adalucinet]]

With Nightly debug build from 2013-11-06 after reloading the testcase for 2 times, I get: "Assertion failure: !unknownProperties(), at ../../../js/src/jsinferinlines.h:1403" on Mac OS X 10.7. Is it the same issue?

No assertion encountered with latest Firefox 28 beta debug build (Build ID: 20140218140834) on:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:28.0) Gecko/20100101 Firefox/28.0
Mozilla/5.0 (X11; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

Comment 9

[Brian Hackett [Laid off!]]

(In reply to Alexandra Lucinet, QA Mentor [:adalucinet] from comment #8)
> With Nightly debug build from 2013-11-06 after reloading the testcase for 2
> times, I get: "Assertion failure: !unknownProperties(), at
> ../../../js/src/jsinferinlines.h:1403" on Mac OS X 10.7. Is it the same
> issue?

Yes.