Closed
Bug 452565
Opened 16 years ago
Closed 16 years ago
TM: "Assertion failure: !(sprop->attrs & JSPROP_READONLY)" with assignment to const
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.1b1
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: assertion, testcase)
js -j
js> const c; (function() { for (var j=0;j<5;++j) { c = 1; } })()
Assertion failure: !(sprop->attrs & JSPROP_READONLY), at jsinterp.cpp:4447
Tracemonkey branch. Another fun "failure in the interpreter, but only when the jit is enabled" bug.
|
||
Comment 1•16 years ago
|
||
This is because we call js_FindPropertyHelper from under TraceRecorder::record_JSOP_SETNAME. brendan added that call, so giving this to him.
Assignee: general → brendan
|
Assignee | |
Updated•16 years ago
|
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b1
|
|
Assignee | |
Comment 2•16 years ago
|
||
This still needs patching. Easier to do now with bug 454039 fixed, but not done yet. /be
|
|
Assignee | |
Comment 3•16 years ago
|
||
Bug 454590 fixed this if I'm not mistaken (with followup work in bug 454689). /be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
||
Comment 4•16 years ago
|
||
fixed by Bug 454744 http://hg.mozilla.org/tracemonkey/rev/d01bf8dcae43 /cvsroot/mozilla/js/tests/js1_5/extensions/regress-452565.js,v <-- regress-452565.js initial revision: 1.1 http://hg.mozilla.org/mozilla-central/rev/d825426a7811
Flags: in-testsuite+
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•