Closed Bug 452565 Opened 12 years ago Closed 12 years ago

TM: "Assertion failure: !(sprop->attrs & JSPROP_READONLY)" with assignment to const

Categories

(Core :: JavaScript Engine, defect, P1, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9.1b1

People

(Reporter: jruderman, Assigned: brendan)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

js -j     
js> const c; (function() { for (var j=0;j<5;++j) { c = 1; } })()

Assertion failure: !(sprop->attrs & JSPROP_READONLY), at jsinterp.cpp:4447

Tracemonkey branch.  Another fun "failure in the interpreter, but only when the jit is enabled" bug.
This is because we call js_FindPropertyHelper from under TraceRecorder::record_JSOP_SETNAME. brendan added that call, so giving this to him.
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b1
This still needs patching. Easier to do now with bug 454039 fixed, but not done yet.

/be
Bug 454590 fixed this if I'm not mistaken (with followup work in bug 454689).

/be
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
fixed by Bug 454744 http://hg.mozilla.org/tracemonkey/rev/d01bf8dcae43

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-452565.js,v  <--  regress-452565.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/d825426a7811
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.