Closed Bug 556525 Opened 15 years ago Closed 15 years ago

JM: Crash [@ js::SweepScopeProperties] or "Assertion failure: !JSVAL_IS_NULL(id), at ../jsscope.cpp"

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9.3a4

People

(Reporter: gkw, Assigned: dmandelin)

References

Details

(4 keywords)

Crash Data

for each(x in [new Number]) (function() { x.__proto__ = [] })() ++x[x] crashes js opt shell on JM tip with -m at js::SweepScopeProperties at null and asserts js debug shell on JM tip with -m at Assertion failure: !JSVAL_IS_NULL(id), at ../jsscope.cpp:330
Finally! A bug 497789 regression I can fix! ;-) /be
Assignee: general → brendan
Blocks: 497789
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.3a4
Sorry, missed the JM. Seems like an sprop rooting bug. The Daves can handle this. /be
Assignee: brendan → dvander
Assignee: dvander → dmandelin
We were missing a few error checks. http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/f903f852e970
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Crash Signature: [@ js::SweepScopeProperties]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug556525.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.