Closed
Bug 645629
Opened 14 years ago
Closed 14 years ago
TI+JM: Assertion failure: ((size_t)atom & 0x7) == 0, at ../jsatom.h:73
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
|
1.13 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
--
o1 = {};
o1 = 2;
function f(o) {
o.__defineGetter__('valueOf', o6);
}
new f(o1);
f(o1);
--
$ ./js -a -n -m test.js
Assertion failure: ((size_t)atom & 0x7) == 0, at ../jsatom.h:73
|
Assignee | |
Comment 1•14 years ago
|
||
We did not always pass the atom pointer to stubs::CallProp. This could either crash or assert, depending on the value previously in Registers::ArgReg1.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #522620 -
Flags: review?(bhackett1024)
|
||
Updated•14 years ago
|
Attachment #522620 -
Flags: review?(bhackett1024) → review+
|
|
||
Comment 2•14 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•