Closed Bug 596873 Opened 14 years ago Closed 14 years ago

"Assertion failure: JSVAL_IS_DOUBLE_IMPL(data)"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 596805
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

var obj = function(){}; for (var v in obj) {} obj.a = ""; obj.b = "false"; delete obj.a; Object.defineProperty(obj, "b", ({enumerable: false})); Object.defineProperty(obj, "c", ({})); Assertion failure: JSVAL_IS_DOUBLE_IMPL(data), at js/src/jsvalue.h:695 The first bad revision is: changeset: 53414:b1facf8ba54e user: Brendan Eich <brendan@mozilla.org> date: Thu Sep 02 14:50:44 2010 -0700 summary: Eliminate JSObject::freeslot via monotonic lastProp->freeslot (bug 592556, r=jorendorff,dvander). Seems similar to bug 596805.
blocking2.0: --- → ?
Fixed by patch in progress for bug 596805. /be
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
blocking2.0: ? → betaN+
(In reply to Brendan Eich [:brendan] from comment #1) > Fixed by patch in progress for bug 596805. /be *** This bug has been > marked as a duplicate of bug 596805 *** where can get the patch to fix bug 596805? I am not authorized to access bug #596805. Thanks a lot.
The fix (http://hg.mozilla.org/mozilla-central/rev/7ef107ab081e) was included in Firefox 4.
You need to log in before you can comment on or make changes to this bug.