459628 - TM: "Assertion failure: JSVAL_IS_VOID(STOBJ_GET_SLOT(obj, map->freeslot))" with new Date

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: gdb output (bt, bt full)

./js -j
js> (function() { for (var odjoff = 0; odjoff < 4; ++odjoff) { new Date()[0] = 3; } })()

Assertion failure: JSVAL_IS_VOID(STOBJ_GET_SLOT(obj, map->freeslot)), at jsobj.cpp:3004

Comment 1

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/0e06273117f5

Comment 2

[Brendan Eich [:brendan]]

Cc'ing perpetrators ;-).

/be

Comment 3

[Boris Zbarsky [:bzbarsky]]

Doh.  Insufficiently good cut-n-paste on my part... :(  I think I + reviewers are the only perpetrators and Blake is blameless!

Comment 4

[Brendan Eich [:brendan]]

(In reply to comment #3)
> Doh.  Insufficiently good cut-n-paste on my part... :(  I think I + reviewers

Ulp, that would be me (see bug 456165).

I will do something to improve object allocation code, common the slot-voiding loop at least.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-459628.js,v  <--  regress-459628.js
initial revision: 1.1