Closed Bug 416406 Opened 17 years ago Closed 17 years ago

Assertion failure: JS_PROPERTY_CACHE(cx).disabled >= 0, at jsinterp.c:457

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9beta4

People

(Reporter: bc, Assigned: brendan)

References

Details

(Keywords: crash, regression, testcase)

Attachments

(1 file)

ecma_3/RegExp/regress-285219.js
ecma_3/Regress/regress-385393-04.js
js1_5/Regress/regress-326467.js
js1_5/Regress/regress-355556.js
js1_6/Array/regress-320887.js
js1_6/Regress/regress-320172.js
js1_6/Regress/regress-382509.js
js1_7/regress/regress-351503-01.js
js1_7/regress/regress-351503-02.js
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.9?
Non-minimal change required by disabling early. I considered making the if (!scopeobj) {...} an if/else and disabling in both clauses but this is better.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #302211 - Flags: review?(shaver)
Attachment #302211 - Flags: approval1.9+
Flags: blocking1.9? → blocking1.9+
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9beta4
Comment on attachment 302211 [details] [diff] [review]
Fatigue showing here

Oof, I should have caught that, I looked right at it. :( r=shaver
Attachment #302211 - Flags: review?(shaver) → review+
Fixed:

js/src/jsobj.c 3.426

/be
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
v
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: