[ObjShrink] "Assertion failure: hasSlot() && !hasMissingSlot(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

({assertion, testcase})

Trunk
x86
Windows 7
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
Object.defineProperty(Namespace.prototype, "toString", {
    enumerable: true
})

asserts js debug shell on JM changeset a335853be219 without any CLI arguments at Assertion failure: hasSlot() && !hasMissingSlot(),
(Assignee)

Comment 1

6 years ago
Misuse of shape->slot() within an assertion, shape->maybeSlot() should have been used instead.

https://hg.mozilla.org/projects/jaegermonkey/rev/198c47f803c1
Assignee: general → blackconnect
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Component: JavaScript Engine → Java-Implemented Plugins
QA Contact: general → blackconnect
Resolution: --- → FIXED
(Assignee)

Updated

6 years ago
Assignee: blackconnect → bhackett1024
Component: Java-Implemented Plugins → JavaScript Engine
QA Contact: blackconnect → general
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug703818.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.