Closed
Bug 593580
Opened 14 years ago
Closed 14 years ago
"Assertion failure: !p,"
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
Tracking | Status | |
---|---|---|
blocking2.0 | --- | betaN+ |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
3.46 KB,
text/plain
|
Details |
realEval = eval f = eval("(function(){for(let x in[\ __defineGetter__(\"\",function(){})\ ,__defineGetter__(\"\ functional\ \",Math.pow)\ ]){\ (__defineSetter__(\"\",function(){}))\ ()\ }})") try { f() } catch (r) { delete this.eval delete this.Math eval = realEval e = this.toSource } f = eval("(function(){(__defineSetter__(\"\ functional\ \",(function(){return{t:function(){}}})))()})") try { f() } catch (r) { eval() } asserts js debug shell on TM changeset 60af58b42567 without -m nor -j at Assertion failure: !p, (pass the testcase in as a CLI argument to reproduce)
Reporter | ||
Updated•14 years ago
|
blocking2.0: --- → ?
Reporter | ||
Comment 1•14 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 52709:cb719643afc5 user: Brendan Eich date: Wed Aug 18 11:34:13 2010 -0700 summary: Bug 535629 - Deleted properties' slots are not recycled (r=gal).
Updated•14 years ago
|
blocking2.0: ? → betaN+
Comment 2•14 years ago
|
||
I'm able to repro on the original cset, but not on TM tip.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
Reporter | ||
Comment 3•14 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 53415:3feb012b18a3 user: Brendan Eich date: Thu Sep 02 18:46:11 2010 -0700 summary: Bugs in dictionary-mode property table maintenance (593256, r=jorendorff).
Resolution: WORKSFORME → FIXED
Comment 4•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•