"Assertion failure: slot == obj->freeslot,"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
4 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Reporter)

Description

7 years ago
function z(b) {
 if (b) this.x = Object;
 this.__defineGetter__("x", encodeURIComponent)
 this.c = delete s
}
for each(a in [/x/, 0]) {
 new z(a)
}

asserts js debug shell on TM changeset 60af58b42567 without -m nor -j at Assertion failure: slot == obj->freeslot,
(Reporter)

Comment 1

7 years ago
Probably related to bug 558451.

Regression window:

http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=be9979b4c10b&tochange=f3e58c264932
Blocks: 558451

Updated

7 years ago
blocking2.0: ? → betaN+
Gary, care to bisect for the fix-patch and change from WFM to FIXED?

/be
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WORKSFORME

Comment 3

7 years ago
The first good revision is:
changeset:   53414:b1facf8ba54e
user:        Brendan Eich <brendan@mozilla.org>
date:        Thu Sep 02 14:50:44 2010 -0700
summary:     Eliminate JSObject::freeslot via monotonic lastProp->freeslot (bug 592556, r=jorendorff,dvander).

Updated

7 years ago
Resolution: WORKSFORME → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.