"Assertion failure: proto" with ArrayBuffer

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
x86_64
Mac OS X
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 540330 [details]
testcase (crashes Firefox when loaded)

Assertion failure: proto, at js/src/jsobj.cpp:4900

(in LookupPropertyWithFlagsInline)

I only see this on the TM branch. I'm guessing it's a regression from bug 656519.
The fix for bug 665355 seems to fix this too, please confirm.
(Reporter)

Comment 2

6 years ago
Yes, the patch makes the assertion failure go away. With the patch, length is 1.
(Reporter)

Updated

6 years ago
Depends on: 665355
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.