Closed Bug 618575 Opened 9 years ago Closed 9 years ago

"Assertion failure: &pobj->getSlot(shape->slot).toObject() == &shape->methodObject(),"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 561359
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase)

(function () {
  (eval("\
    (function(){\
      for(let y in[0,0]){\
        (b=Proxy.createFunction((function(){\
          return{get:function(){}}\
        })(<x/>),function(){<x/>}))}})\
"))()
})();
(eval("(function(){for(let b=(b.(d))in x){}})"))()

asserts js debug shell on TM changeset 1002cba2f2d6 without -m or -j at Assertion failure: &pobj->getSlot(shape->slot).toObject() == &shape->methodObject(),
blocking2.0: --- → ?
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   52720:66c8ad02543b
user:        Luke Wagner
date:        Mon Aug 16 12:35:04 2010 -0700
summary:     Bug 581263 - remove slow natives (r=waldo,mrbkap)
Blocks: 581263
Although it hits on slow native removal, applying the fixing-the-bug-but-not-the-right-fix patch from bug 561359 makes the assertion go away.

Jason: I don't know, but this might be a useful test case to add in addition to the one in bug 561359.
No longer blocks: 581263
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 561359
blocking2.0: ? → betaN+
A testcase for this bug was already added in the original bug (bug 561359).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.