Closed
Bug 593605
Opened 15 years ago
Closed 15 years ago
"Assertion failure: slot == obj->freeslot,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | betaN+ |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
function z(b) {
if (b) this.x = Object;
this.__defineGetter__("x", encodeURIComponent)
this.c = delete s
}
for each(a in [/x/, 0]) {
new z(a)
}
asserts js debug shell on TM changeset 60af58b42567 without -m nor -j at Assertion failure: slot == obj->freeslot,
|
Reporter | |
Comment 1•15 years ago
|
||
Probably related to bug 558451.
Regression window:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=be9979b4c10b&tochange=f3e58c264932
Blocks: 558451
|
||
Updated•15 years ago
|
blocking2.0: ? → betaN+
|
|
||
Comment 2•15 years ago
|
||
Gary, care to bisect for the fix-patch and change from WFM to FIXED?
/be
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
|
||
Comment 3•15 years ago
|
||
The first good revision is:
changeset: 53414:b1facf8ba54e
user: Brendan Eich <brendan@mozilla.org>
date: Thu Sep 02 14:50:44 2010 -0700
summary: Eliminate JSObject::freeslot via monotonic lastProp->freeslot (bug 592556, r=jorendorff,dvander).
|
|
||
Updated•15 years ago
|
Resolution: WORKSFORME → FIXED
|
||
Comment 4•13 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•