Closed
Bug 613122
Opened 15 years ago
Closed 15 years ago
"Assertion failure: capacity >= fixed"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
|
1.43 KB,
text/plain
|
Details | |
|
1009 bytes,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
var a = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1];
a.push(1);
a.splice(0);
a.d = "";
Assertion failure: capacity >= fixed, at js/src/jsobjinlines.h:677
The first bad revision is:
changeset: bc000c1509ac
user: Brian Hackett
date: Mon Nov 15 17:21:58 2010 -0800
summary: Fix fixed slots invariant for slow arrays, bug 610592. r=brendan
|
Assignee | |
Comment 1•15 years ago
|
||
Thanks! We would allow the number of slots on an object to shrink below the number of fixed slots, which confused revertToFixedSlots.
Assignee: general → bhackett1024
Attachment #491449 -
Flags: review?(brendan)
|
||
Updated•15 years ago
|
Attachment #491449 -
Flags: review?(brendan) → review+
|
|
Assignee | |
Comment 2•15 years ago
|
||
Whiteboard: fixed-in-tracemonkey
|
||
Comment 3•15 years ago
|
||
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
|
||
Comment 4•13 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug613122.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•