Steps to reproduce: 1. Make sure the testcase is allowed to open popup windows (to force GC). 2. Load the testcase. Result: Mac debug: Always aborts with "Assertion failure: prop, at jsfun.c:1046" Mac nightly: Sometimes crashes [@ js_SetCallVariable]. Expected: No crash or assertion failure. I spent many hours trying to create a reduced testcase for this crash. I hope it's useful.
Created attachment 212284 [details] [diff] [review] Proposed fix We can't assume that we're going to find the prototype property -- we'd normally find it on the proto chain, but that's been severed!
Comment on attachment 212284 [details] [diff] [review] Proposed fix No-brainer for branches. /be
Fix checked into trunk.
Verified fixed using today's Mac nightly.
Fix checked into the 1.8 branches.
Checking in regress-327608.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-327608.js,v <-- regress-327608.js initial revision: 1.1 done
Marking [rft-dl] (ready for testing in Firefox 22.214.171.124 release candidates) since in-testsuite+ indicates a test case exists in the js test library.
v ff 126.96.36.199/1.8/1.9 20060302 win/linux/mac