Closed Bug 697155 Opened 13 years ago Closed 13 years ago

TM: "Assertion failure: shape->previous() == obj->lastProperty()," with gc

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

VERIFIED WONTFIX
Tracking Status
firefox7 - wontfix
firefox8 - wontfix
firefox9 - unaffected
firefox10 - unaffected
status1.9.2 --- unaffected

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [sg:critical?] js-triage-needed)

Attachments

(1 file)

Attached file stack
function f(o) { for (x in { x: function() { return a } })({ x: function() { return a } }) gc() } for (var i = 0; i < 12; i++) { f(new Number) } asserts js debug shell on m-c changeset 6cd262091470 with -j at Assertion failure: shape->previous() == obj->lastProperty(), s-s because gc is involved. Assuming [sg:critical?] unless otherwise shown. autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 71353:dc137da5a3b4 user: Igor Bukanov date: Tue May 31 10:01:09 2011 +0200 summary: Bug 657198 - improving unreachable GC things detection in traces. r=gal
Not going to try to rush this in for 8.
This can't affect content in Fx 9+ in the default config because the tracer is not enabled there.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WONTFIX
VERIFIED based on the fact that tracer (-j) is now long gone.
Status: RESOLVED → VERIFIED
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: