JM: "Assertion failure: sprop->writable(), at ../jsops.cpp"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
8 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

8 years ago
try {
  (function() {
    (Object.defineProperty(this, "x", ({
      set: function() {}
    })))
  })()
} catch(e) {}
for (var a = 0; a < 4; a++) {
  x = 7
}

asserts js debug shell on TM tip without -j at Assertion failure: sprop->writable(), at ../jsops.cpp:1697
(Reporter)

Comment 1

8 years ago
Whoops this is a JM bug... autoBisect coming up...
Blocks: 549412
Summary: "Assertion failure: sprop->writable(), at ../jsops.cpp" → JM: "Assertion failure: sprop->writable(), at ../jsops.cpp"
This is fixed on TM, looks like I'll have to do another merge shortly.
(Reporter)

Comment 3

8 years ago
(In reply to comment #2)
> This is fixed on TM, looks like I'll have to do another merge shortly.

Oh great, so I can move autoBisect on to another bug. :)
What needs to happen in this bug? Is it worth adding this as a test?
(Reporter)

Comment 5

8 years ago
(In reply to comment #4)
> What needs to happen in this bug? Is it worth adding this as a test?

Yes, I would think.
We've merged with TM so this is fixed (pushed a test case for good measure).
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
(Reporter)

Comment 7

8 years ago
(In reply to comment #6)
> We've merged with TM so this is fixed (pushed a test case for good measure).

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/aa3609bf42d9
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug560221.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.