Last Comment Bug 665356 - "Assertion failure: proto" with ArrayBuffer
: "Assertion failure: proto" with ArrayBuffer
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on: 665355
Blocks: 326633 656519
  Show dependency treegraph
 
Reported: 2011-06-19 09:20 PDT by Jesse Ruderman
Modified: 2011-07-06 09:51 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes Firefox when loaded) (145 bytes, text/html)
2011-06-19 09:20 PDT, Jesse Ruderman
no flags Details

Description Jesse Ruderman 2011-06-19 09:20:52 PDT
Created attachment 540330 [details]
testcase (crashes Firefox when loaded)

Assertion failure: proto, at js/src/jsobj.cpp:4900

(in LookupPropertyWithFlagsInline)

I only see this on the TM branch. I'm guessing it's a regression from bug 656519.
Comment 1 Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?) 2011-06-20 09:57:40 PDT
The fix for bug 665355 seems to fix this too, please confirm.
Comment 2 Jesse Ruderman 2011-06-20 17:34:39 PDT
Yes, the patch makes the assertion failure go away. With the patch, length is 1.

Note You need to log in before you can comment on or make changes to this bug.