Last Comment Bug 698899 - TI: "Assertion failure: type->canProvideEmptyShape(clasp),"
: TI: "Assertion failure: type->canProvideEmptyShape(clasp),"
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress 630996 684410
  Show dependency treegraph
Reported: 2011-11-01 14:37 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 14:20 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (5.19 KB, text/plain)
2011-11-01 14:37 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description User image Gary Kwong [:gkw] [:nth10sd] 2011-11-01 14:37:34 PDT
Created attachment 571145 [details]

o = evalcx("lazy").__proto__
try {
} catch (e) {}

asserts js debug shell on JM changeset f951e9151626 with -n at Assertion failure: type->canProvideEmptyShape(clasp),

Related to bug 698150 ?

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   78127:40f829990c82
user:        Brian Hackett
date:        Fri Oct 07 20:09:09 2011 -0700
summary:     Move JSObject::newType to a hashtable, bug 684410.
Comment 1 User image Gary Kwong [:gkw] [:nth10sd] 2011-11-28 15:22:48 PST
This was likely fixed by bug 684507.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   79618:3e9445901e8b
user:        Brian Hackett
date:        Wed Nov 02 13:34:19 2011 -0700
summary:     Remove JSObject::isNewborn, refactor object creation code, bug 684507.
Comment 2 User image Christian Holler (:decoder) 2013-01-19 14:20:24 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.