Closed Bug 936854 Opened 6 years ago Closed 6 years ago

Assertion failure: !isOwned() && !unowned_, at vm/Shape.h

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: gkw, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack
try {
    (function() {
        x = Proxy.createFunction((function() {
            return {
                defineProperty: function() {},
                delete: function() {},
                enumerate: undefined,
                fix: function() {},
                get: function() {},
                getOwnPropertyDescriptor: function() {},
                getOwnPropertyNames: Uint16Array,
                g: function() {},
                s: function() {},
                a: function() {},
                iterate: arguments.callee.caller,
                s: function() {},
                t: function() {}
            }
        })(), String.prototype.toSource)
    })()
    for (let d in [])(function() {
            _(function() {
                return {
                    defineProperty: function() {},
                    delete: function() {},
                    enumerate: d,
                    fix: c,
                    get: function() {},
                    getOwnPropertyDescriptor: function() {},
                    getOwnPropertyNames: c,
                    r: function() {},
                    s: function() {},
                    n: function() {},
                    e: f,
                    s: c,
                    t: n
                }
            })
        })()
} catch (e) {}
try {
    (function() {
        for (c in x)(a((function() {
                return {
                    defineProperty: function() {},
                    delete: l,
                    enumerate: function() {},
                    fix: function() {},
                    get: o,
                    getOwnPropertyDescriptor: function() {},
                    getOwnPropertyNames: c,
                    r: function() {},
                    s: function() {},
                    n: f,
                    e: d,
                    s: function() {},
                    t: function() {}
                }
            })(let(l) e)(c, "")))((function() {
                return {
                    defineProperty: d,
                    delete: d,
                    enumerate: function() {},
                    fix: function() {},
                    get: function() {},
                    getOwnPropertyDescriptor: function() {},
                    getOwnPropertyNames: d,
                    g: function() {},
                    s: function() {},
                    a: function() {},
                    e: d,
                    s: c,
                    t: function() {}
                }
            }))(function() {
                ((((function() {
                    return {
                        defineProperty: c,
                        delete: function() {},
                        enumerate: function() {},
                        fix: d,
                        get: function() {},
                        getOwnPropertyDescriptor: f,
                        getOwnPropertyNames: function() {},
                        r: d,
                        s: function() {},
                        n: c,
                        e: function() {},
                        s: d,
                        t: function() {}
                    }
                }((b))))))
                (((function() {
                    return {
                        defineProperty: f,
                        delete: function() {},
                        enumerate: c,
                        fix: function() {},
                        get: function() {},
                        getOwnPropertyDescriptor: c,
                        getOwnPropertyNames: function() {},
                        r: f,
                        s: function() {},
                        n: function() {},
                        e: function() {},
                        s: function() {},
                        t: c
                    }
                })(), function() {}))
            })((function() {
                return {
                    defineProperty: function() {},
                    delete: function() {},
                    enumerate: g,
                    fix: f,
                    get: function() {},
                    getOwnPropertyDescriptor: function() {},
                    getOwnPropertyNames: function() {},
                    r: function() {},
                    s: function() {},
                    a: o,
                    e: function() {},
                    s: function() {},
                    t: function() {}
                }
            }(undefined)), s)
    })()
} catch (e) {}

asserts js debug shell on m-c changeset 16949049f03d without any CLI arguments at Assertion failure: !isOwned() && !unowned_, at vm/Shape.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
user:        Brian Hackett
date:        Thu Nov 07 11:12:15 2013 -0800
summary:     Bug 935324 - Clean up adding of type properties to objects, r=jandem.

Brian, is bug 935324 a likely regressor?
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
Oops, calling the wrong function.
Assignee: general → bhackett1024
Attachment #831690 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #831690 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/c2e9c1bbd258
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in before you can comment on or make changes to this bug.