Closed
Bug 697155
Opened 13 years ago
Closed 13 years ago
TM: "Assertion failure: shape->previous() == obj->lastProperty()," with gc
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
WONTFIX
Tracking | Status | |
---|---|---|
firefox7 | - | wontfix |
firefox8 | - | wontfix |
firefox9 | - | unaffected |
firefox10 | - | unaffected |
status1.9.2 | --- | unaffected |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [sg:critical?] js-triage-needed)
Attachments
(1 file)
4.08 KB,
text/plain
|
Details |
function f(o) {
for (x in {
x: function() {
return a
}
})({
x: function() {
return a
}
})
gc()
}
for (var i = 0; i < 12; i++) {
f(new Number)
}
asserts js debug shell on m-c changeset 6cd262091470 with -j at Assertion failure: shape->previous() == obj->lastProperty(),
s-s because gc is involved. Assuming [sg:critical?] unless otherwise shown.
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 71353:dc137da5a3b4
user: Igor Bukanov
date: Tue May 31 10:01:09 2011 +0200
summary: Bug 657198 - improving unreachable GC things detection in traces. r=gal
Comment 1•13 years ago
|
||
Not going to try to rush this in for 8.
status-firefox10:
--- → affected
status-firefox7:
--- → wontfix
status-firefox8:
--- → wontfix
status-firefox9:
--- → affected
tracking-firefox10:
--- → +
tracking-firefox7:
--- → -
tracking-firefox8:
--- → -
tracking-firefox9:
--- → +
Comment 2•13 years ago
|
||
This can't affect content in Fx 9+ in the default config because the tracer is not enabled there.
Updated•13 years ago
|
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WONTFIX
![]() |
Reporter | |
Comment 3•13 years ago
|
||
VERIFIED based on the fact that tracer (-j) is now long gone.
Status: RESOLVED → VERIFIED
Updated•13 years ago
|
Group: core-security
status1.9.2:
--- → unaffected
You need to log in
before you can comment on or make changes to this bug.
Description
•