Closed
Bug 613122
Opened 14 years ago
Closed 14 years ago
"Assertion failure: capacity >= fixed"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
|
1.43 KB,
text/plain
|
Details | |
|
1009 bytes,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
var a = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]; a.push(1); a.splice(0); a.d = ""; Assertion failure: capacity >= fixed, at js/src/jsobjinlines.h:677 The first bad revision is: changeset: bc000c1509ac user: Brian Hackett date: Mon Nov 15 17:21:58 2010 -0800 summary: Fix fixed slots invariant for slow arrays, bug 610592. r=brendan
|
Assignee | |
Comment 1•14 years ago
|
||
Thanks! We would allow the number of slots on an object to shrink below the number of fixed slots, which confused revertToFixedSlots.
Assignee: general → bhackett1024
Attachment #491449 -
Flags: review?(brendan)
|
||
Updated•14 years ago
|
Attachment #491449 -
Flags: review?(brendan) → review+
|
|
Assignee | |
Comment 2•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/8a888bf6d83c
Whiteboard: fixed-in-tracemonkey
|
||
Comment 3•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/8a888bf6d83c
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Comment 4•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug613122.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•