Closed Bug 556525 Opened 14 years ago Closed 14 years ago

JM: Crash [@ js::SweepScopeProperties] or "Assertion failure: !JSVAL_IS_NULL(id), at ../jsscope.cpp"

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9.3a4

People

(Reporter: gkw, Assigned: dmandelin)

References

Details

(4 keywords)

Crash Data

for each(x in [new Number])
(function() {
  x.__proto__ = []
})()
++x[x]


crashes js opt shell on JM tip with -m at js::SweepScopeProperties at null and asserts js debug shell on JM tip with -m at Assertion failure: !JSVAL_IS_NULL(id), at ../jsscope.cpp:330
Finally! A bug 497789 regression I can fix! ;-)

/be
Assignee: general → brendan
Blocks: 497789
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.3a4
Sorry, missed the JM. Seems like an sprop rooting bug. The Daves can handle this.

/be
Assignee: brendan → dvander
Assignee: dvander → dmandelin
We were missing a few error checks.

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/f903f852e970
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Crash Signature: [@ js::SweepScopeProperties]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug556525.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.