Closed Bug 936854 Opened 11 years ago Closed 11 years ago

Assertion failure: !isOwned() && !unowned_, at vm/Shape.h

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack
try { (function() { x = Proxy.createFunction((function() { return { defineProperty: function() {}, delete: function() {}, enumerate: undefined, fix: function() {}, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: Uint16Array, g: function() {}, s: function() {}, a: function() {}, iterate: arguments.callee.caller, s: function() {}, t: function() {} } })(), String.prototype.toSource) })() for (let d in [])(function() { _(function() { return { defineProperty: function() {}, delete: function() {}, enumerate: d, fix: c, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: c, r: function() {}, s: function() {}, n: function() {}, e: f, s: c, t: n } }) })() } catch (e) {} try { (function() { for (c in x)(a((function() { return { defineProperty: function() {}, delete: l, enumerate: function() {}, fix: function() {}, get: o, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: c, r: function() {}, s: function() {}, n: f, e: d, s: function() {}, t: function() {} } })(let(l) e)(c, "")))((function() { return { defineProperty: d, delete: d, enumerate: function() {}, fix: function() {}, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: d, g: function() {}, s: function() {}, a: function() {}, e: d, s: c, t: function() {} } }))(function() { ((((function() { return { defineProperty: c, delete: function() {}, enumerate: function() {}, fix: d, get: function() {}, getOwnPropertyDescriptor: f, getOwnPropertyNames: function() {}, r: d, s: function() {}, n: c, e: function() {}, s: d, t: function() {} } }((b)))))) (((function() { return { defineProperty: f, delete: function() {}, enumerate: c, fix: function() {}, get: function() {}, getOwnPropertyDescriptor: c, getOwnPropertyNames: function() {}, r: f, s: function() {}, n: function() {}, e: function() {}, s: function() {}, t: c } })(), function() {})) })((function() { return { defineProperty: function() {}, delete: function() {}, enumerate: g, fix: f, get: function() {}, getOwnPropertyDescriptor: function() {}, getOwnPropertyNames: function() {}, r: function() {}, s: function() {}, a: o, e: function() {}, s: function() {}, t: function() {} } }(undefined)), s) })() } catch (e) {} asserts js debug shell on m-c changeset 16949049f03d without any CLI arguments at Assertion failure: !isOwned() && !unowned_, at vm/Shape.h My configure flags are: CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5 user: Brian Hackett date: Thu Nov 07 11:12:15 2013 -0800 summary: Bug 935324 - Clean up adding of type properties to objects, r=jandem. Brian, is bug 935324 a likely regressor?
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
Oops, calling the wrong function.
Assignee: general → bhackett1024
Attachment #831690 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #831690 - Flags: review?(jdemooij) → review+
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: