Closed Bug 469234 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: !JS_ON_TRACE(cx)" with proto, defineSetter

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, testcase) 

js> for(var j=0;j<3;++j)({__proto__:[]}).__defineSetter__('x',function(){});
Assertion failure: !JS_ON_TRACE(cx), at ../jsobj.cpp:3765

Using tracemonkey branch rev 56029d4f6305
After bug 470388 got fixed, this assertion comes up pretty often when jsfunfuzz-ing. Nominating blocking-1.9.1 because of this.

Seems to be TM-only.
Flags: blocking1.9.1?
Summary: "Assertion failure: !JS_ON_TRACE(cx)" with proto, defineSetter → TM: "Assertion failure: !JS_ON_TRACE(cx)" with proto, defineSetter
This seems to have been fixed by the patch in bug 474771.
Status: NEW → RESOLVED
Closed: 16 years ago
Depends on: 474771
Resolution: --- → FIXED
Bug 474771 is blocking, so clearing the request here.
Flags: blocking1.9.1?
http://hg.mozilla.org/tracemonkey/rev/e028e96740cc
/cvsroot/mozilla/js/tests/js1_7/extensions/regress-469234.js,v  <--  regress-469234.js
initial revision: 1.1
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.