Last Comment Bug 665356 - "Assertion failure: proto" with ArrayBuffer
: "Assertion failure: proto" with ArrayBuffer
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on: 665355
Blocks: 326633 656519
  Show dependency treegraph
Reported: 2011-06-19 09:20 PDT by Jesse Ruderman
Modified: 2011-07-06 09:51 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (crashes Firefox when loaded) (145 bytes, text/html)
2011-06-19 09:20 PDT, Jesse Ruderman
no flags Details

Description User image Jesse Ruderman 2011-06-19 09:20:52 PDT
Created attachment 540330 [details]
testcase (crashes Firefox when loaded)

Assertion failure: proto, at js/src/jsobj.cpp:4900

(in LookupPropertyWithFlagsInline)

I only see this on the TM branch. I'm guessing it's a regression from bug 656519.
Comment 1 User image Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?) 2011-06-20 09:57:40 PDT
The fix for bug 665355 seems to fix this too, please confirm.
Comment 2 User image Jesse Ruderman 2011-06-20 17:34:39 PDT
Yes, the patch makes the assertion failure go away. With the patch, length is 1.

Note You need to log in before you can comment on or make changes to this bug.