Closed Bug 698581 Opened 10 years ago Closed 10 years ago

"Assertion failure: obj->isExtensible(),"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 686296

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: js-triage-needed)

Attachments

(1 file)

Attached file stack
a = (new Uint8ClampedArray).buffer
b = {}.__proto__
for (var i = 0; i < 2; i++) {
    props = Object.getOwnPropertyNames(b)
    prop = props[props.length - 1] + "p"
    b[prop] = a
}
for each(y in []) {
    y.__proto__ = function() {};
    Object.seal(y)
}

asserts js debug shell on m-c changeset 6cd262091470 with -m at Assertion failure: obj->isExtensible(),

Related to bug 686296 ?

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   71625:b4f74f6e8396
user:        Nikhil Marathe
date:        Wed Jun 29 17:41:35 2011 -0700
summary:     Bug 665355 - Fix __proto__ recursion. r=mrbkap
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 686296
A testcase for this bug was already added in the original bug (bug 686296).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.