630340 - Compartment assertion with undefined value

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

At the end of DefinePropertyOnObject, we call CallJSPropertyOp with an out-parameter |dummy|. It does a compartment assertion on this value, which is undefined. Found with valgrind.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: fix

Comment 2

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/d3e265afe157
Note: not marking as fixed because fixed-in-tracemonkey is not present on the whiteboard.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

http://hg.mozilla.org/tracemonkey/rev/d3e265afe157