Closed
Bug 936854
Opened 11 years ago
Closed 11 years ago
Assertion failure: !isOwned() && !unowned_, at vm/Shape.h
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: gkw, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
7.55 KB,
text/plain
|
Details | |
840 bytes,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
try {
(function() {
x = Proxy.createFunction((function() {
return {
defineProperty: function() {},
delete: function() {},
enumerate: undefined,
fix: function() {},
get: function() {},
getOwnPropertyDescriptor: function() {},
getOwnPropertyNames: Uint16Array,
g: function() {},
s: function() {},
a: function() {},
iterate: arguments.callee.caller,
s: function() {},
t: function() {}
}
})(), String.prototype.toSource)
})()
for (let d in [])(function() {
_(function() {
return {
defineProperty: function() {},
delete: function() {},
enumerate: d,
fix: c,
get: function() {},
getOwnPropertyDescriptor: function() {},
getOwnPropertyNames: c,
r: function() {},
s: function() {},
n: function() {},
e: f,
s: c,
t: n
}
})
})()
} catch (e) {}
try {
(function() {
for (c in x)(a((function() {
return {
defineProperty: function() {},
delete: l,
enumerate: function() {},
fix: function() {},
get: o,
getOwnPropertyDescriptor: function() {},
getOwnPropertyNames: c,
r: function() {},
s: function() {},
n: f,
e: d,
s: function() {},
t: function() {}
}
})(let(l) e)(c, "")))((function() {
return {
defineProperty: d,
delete: d,
enumerate: function() {},
fix: function() {},
get: function() {},
getOwnPropertyDescriptor: function() {},
getOwnPropertyNames: d,
g: function() {},
s: function() {},
a: function() {},
e: d,
s: c,
t: function() {}
}
}))(function() {
((((function() {
return {
defineProperty: c,
delete: function() {},
enumerate: function() {},
fix: d,
get: function() {},
getOwnPropertyDescriptor: f,
getOwnPropertyNames: function() {},
r: d,
s: function() {},
n: c,
e: function() {},
s: d,
t: function() {}
}
}((b))))))
(((function() {
return {
defineProperty: f,
delete: function() {},
enumerate: c,
fix: function() {},
get: function() {},
getOwnPropertyDescriptor: c,
getOwnPropertyNames: function() {},
r: f,
s: function() {},
n: function() {},
e: function() {},
s: function() {},
t: c
}
})(), function() {}))
})((function() {
return {
defineProperty: function() {},
delete: function() {},
enumerate: g,
fix: f,
get: function() {},
getOwnPropertyDescriptor: function() {},
getOwnPropertyNames: function() {},
r: function() {},
s: function() {},
a: o,
e: function() {},
s: function() {},
t: function() {}
}
}(undefined)), s)
})()
} catch (e) {}
asserts js debug shell on m-c changeset 16949049f03d without any CLI arguments at Assertion failure: !isOwned() && !unowned_, at vm/Shape.h
My configure flags are:
CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
user: Brian Hackett
date: Thu Nov 07 11:12:15 2013 -0800
summary: Bug 935324 - Clean up adding of type properties to objects, r=jandem.
Brian, is bug 935324 a likely regressor?
Flags: needinfo?(bhackett1024)
Assignee | ||
Comment 1•11 years ago
|
||
Oops, calling the wrong function.
Assignee: general → bhackett1024
Attachment #831690 -
Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Updated•11 years ago
|
Attachment #831690 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 2•11 years ago
|
||
Comment 3•11 years ago
|
||
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in
before you can comment on or make changes to this bug.
Description
•