892714 - Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40), at vm/Shape.cpp with Proxy

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    Object.defineProperty(this, "", {
        enumerable: true,
        get: function() {
            x = this
        }
    })
    for (z in Proxy(this, this)());
} catch (e) {}
Object.freeze(x)

asserts js debug shell on m-c changeset 8aca531ff163 without any CLI arguments at Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40), at vm/Shape.cpp

I searched and also found bug 867082 but that seems to point to a different regressing changeset and that testcase also does not involve Proxy.

This needs a js shell that is compiled with --enable-more-deterministic.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/09dcdc2b2120
user:        Sankha Narayan Guria
date:        Tue Jul 02 21:57:14 2013 +0530
summary:     Bug 788172 - Make Proxy a function. r=ejpbruel

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Christian Holler (:decoder) from comment #1)
> JSBugMon: Cannot process bug: Unable to automatically reproduce, please
> track manually.

AFAIK this testcase needs --enable-more-deterministic which JSBugMon doesn't compile with, so I'd think that this bug is still valid.

Comment 3

[Sankha Narayan Guria [:sankha]]

I had only rebased the patch. Over to jorendorff, who worked on the bug.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

It seems highly likely that bug 867082 (same assertion) fixed this too.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8a658a424d35
user:        Jan de Mooij
date:        Tue Jul 16 15:05:02 2013 +0200
summary:     Bug 867082 - Use JSPROP_SHARED for the customNative global property in the JS shell. r=jwalden