Closed Bug 683999 Opened 9 years ago Closed 9 years ago
"Assertion failure: has
Singleton Type()" in JSObject::splice Prototype (jsinfer .cpp)
Assertion failure: hasSingletonType(), at js/src/jsinfer.cpp:5071
TI adds a JS_SplicePrototype API function which allows XPConnect to rearrange the prototype chain while preserving precise types for global properties etc. This is only intended to be used for objects with singleton types (where we can do this rearranging), but because of mutable __proto__ other objects may get passed in instead. Fix makes this function robust for such objects.
Attachment #558530 - Flags: review?(dvander)
Attachment #558530 - Flags: review?(dvander) → review+
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Filter on qa-project-auto-change: Bug in removed tracer code, setting in-testsuite- flag.
You need to log in before you can comment on or make changes to this bug.