Closed
Bug 936854
Opened 11 years ago
Closed 11 years ago
Assertion failure: !isOwned() && !unowned_, at vm/Shape.h
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: gkw, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
7.55 KB,
text/plain
|
Details | |
840 bytes,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
try { (function() { x = Proxy.createFunction((function() { return { defineProperty: function() {}, delete: function() {}, enumerate: undefined, fix: function() {}, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: Uint16Array, g: function() {}, s: function() {}, a: function() {}, iterate: arguments.callee.caller, s: function() {}, t: function() {} } })(), String.prototype.toSource) })() for (let d in [])(function() { _(function() { return { defineProperty: function() {}, delete: function() {}, enumerate: d, fix: c, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: c, r: function() {}, s: function() {}, n: function() {}, e: f, s: c, t: n } }) })() } catch (e) {} try { (function() { for (c in x)(a((function() { return { defineProperty: function() {}, delete: l, enumerate: function() {}, fix: function() {}, get: o, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: c, r: function() {}, s: function() {}, n: f, e: d, s: function() {}, t: function() {} } })(let(l) e)(c, "")))((function() { return { defineProperty: d, delete: d, enumerate: function() {}, fix: function() {}, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: d, g: function() {}, s: function() {}, a: function() {}, e: d, s: c, t: function() {} } }))(function() { ((((function() { return { defineProperty: c, delete: function() {}, enumerate: function() {}, fix: d, get: function() {}, getOwnPropertyDescriptor: f, getOwnPropertyNames: function() {}, r: d, s: function() {}, n: c, e: function() {}, s: d, t: function() {} } }((b)))))) (((function() { return { defineProperty: f, delete: function() {}, enumerate: c, fix: function() {}, get: function() {}, getOwnPropertyDescriptor: c, getOwnPropertyNames: function() {}, r: f, s: function() {}, n: function() {}, e: function() {}, s: function() {}, t: c } })(), function() {})) })((function() { return { defineProperty: function() {}, delete: function() {}, enumerate: g, fix: f, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: function() {}, r: function() {}, s: function() {}, a: o, e: function() {}, s: function() {}, t: function() {} } }(undefined)), s) })() } catch (e) {} asserts js debug shell on m-c changeset 16949049f03d without any CLI arguments at Assertion failure: !isOwned() && !unowned_, at vm/Shape.h My configure flags are: CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5 user: Brian Hackett date: Thu Nov 07 11:12:15 2013 -0800 summary: Bug 935324 - Clean up adding of type properties to objects, r=jandem. Brian, is bug 935324 a likely regressor?
Flags: needinfo?(bhackett1024)
Assignee | ||
Comment 1•11 years ago
|
||
Oops, calling the wrong function.
Assignee: general → bhackett1024
Attachment #831690 -
Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Updated•11 years ago
|
Attachment #831690 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 2•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/c2e9c1bbd258
Comment 3•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/c2e9c1bbd258
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in
before you can comment on or make changes to this bug.
Description
•