Closed
Bug 537854
Opened 15 years ago
Closed 14 years ago
"Assertion failure: !(sprop->flags & SPROP_IS_METHOD)" or "Assertion failure: !sprop->isMethod(), at ../jsscope.cpp" with watch
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.3a2
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | betaN+ |
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
904 bytes,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
({x:function(){}}).watch('x',function(){});
|
Reporter | |
Comment 1•15 years ago
|
||
Assertion failure: !(sprop->flags & SPROP_IS_METHOD), at ../jsscope.cpp:1496 Affects PPC and ARM, but not x86.
|
|
Reporter | |
Comment 2•15 years ago
|
||
This assertion was added in rev bb4f39064bf0. user: Robert Sayre date: Tue Dec 01 15:49:15 2009 -0500 summary: Relanding: Bye-bye middle-deletes and their O(n^2) worst case complexity; hello dictionary-mode scopes (473228, r=jorendorff). Backed out changeset ee7bfc1923ad
|
||
Comment 3•15 years ago
|
||
autoBisect shows this is probably related to bug 529837: The first bad revision is: changeset: 35214:a71067721eb0 user: Brendan Eich date: Tue Nov 24 15:15:37 2009 -0800 summary: Undo hackaround for bug 529837. I am not sure why autoBisect points to a different checkin, and the testcase in comment #0 affects both 32-bit and 64-bit in Snow Leopard 10.6, in contrary to comment #1.
|
|
||
Comment 4•14 years ago
|
||
$ ./js-dbg-32-tm-darwin
js> ({x:function(){}}).watch('x',function(){});
Assertion failure: !sprop->isMethod(), at ../jsscope.cpp:1472
Bus error
Now asserts in a slightly different assert message on TM tip without -j in a debug js build.blocking2.0: --- → ?
Summary: "Assertion failure: !(sprop->flags & SPROP_IS_METHOD)" with watch → "Assertion failure: !(sprop->flags & SPROP_IS_METHOD)" or "Assertion failure: !sprop->isMethod(), at ../jsscope.cpp" with watch
|
|
||
Comment 5•14 years ago
|
||
After the assertion morphed, this assertion is now occurring somewhat more often in jsfunfuzz.
|
Assignee | |
Comment 6•14 years ago
|
||
|
|
Assignee | |
Updated•14 years ago
|
OS: Mac OS X → All
Priority: -- → P1
Target Milestone: --- → mozilla1.9.3a2
|
||
Updated•14 years ago
|
Attachment #427917 -
Flags: review?(mrbkap) → review+
|
|
Assignee | |
Comment 7•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/84ffe17d8faf /be
Whiteboard: fixed-in-tracemonkey
|
||
Comment 8•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/84ffe17d8faf
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
|
||
Updated•14 years ago
|
blocking2.0: ? → betaN+
|
||
Comment 9•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•