Closed
Bug 560221
Opened 14 years ago
Closed 14 years ago
JM: "Assertion failure: sprop->writable(), at ../jsops.cpp"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
try { (function() { (Object.defineProperty(this, "x", ({ set: function() {} }))) })() } catch(e) {} for (var a = 0; a < 4; a++) { x = 7 } asserts js debug shell on TM tip without -j at Assertion failure: sprop->writable(), at ../jsops.cpp:1697
Reporter | ||
Comment 1•14 years ago
|
||
Whoops this is a JM bug... autoBisect coming up...
Blocks: JaegerFuzz
Summary: "Assertion failure: sprop->writable(), at ../jsops.cpp" → JM: "Assertion failure: sprop->writable(), at ../jsops.cpp"
This is fixed on TM, looks like I'll have to do another merge shortly.
Reporter | ||
Comment 3•14 years ago
|
||
(In reply to comment #2) > This is fixed on TM, looks like I'll have to do another merge shortly. Oh great, so I can move autoBisect on to another bug. :)
Comment 4•14 years ago
|
||
What needs to happen in this bug? Is it worth adding this as a test?
Reporter | ||
Comment 5•14 years ago
|
||
(In reply to comment #4) > What needs to happen in this bug? Is it worth adding this as a test? Yes, I would think.
We've merged with TM so this is fixed (pushed a test case for good measure).
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 7•14 years ago
|
||
(In reply to comment #6) > We've merged with TM so this is fixed (pushed a test case for good measure). http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/aa3609bf42d9
Comment 8•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug560221.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•