Steps to reproduce:
1. Make sure the testcase is allowed to open popup windows (to force GC).
2. Load the testcase.
Mac debug: Always aborts with "Assertion failure: prop, at jsfun.c:1046"
Mac nightly: Sometimes crashes [@ js_SetCallVariable].
No crash or assertion failure.
I spent many hours trying to create a reduced testcase for this crash. I hope it's useful.
Created attachment 212200 [details]
Created attachment 212284 [details] [diff] [review]
We can't assume that we're going to find the prototype property -- we'd normally find it on the proto chain, but that's been severed!
Comment on attachment 212284 [details] [diff] [review]
No-brainer for branches.
Fix checked into trunk.
Verified fixed using today's Mac nightly.
Fix checked into the 1.8 branches.
Checking in regress-327608.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-327608.js,v <-- regress-327608.js
initial revision: 1.1
Marking [rft-dl] (ready for testing in Firefox 18.104.22.168 release candidates) since in-testsuite+ indicates a test case exists in the js test library.
v ff 22.214.171.124/1.8/1.9 20060302 win/linux/mac