The default bug view has changed. See this FAQ.

Assertion failure: lastProperty()->hasTable(), at js/src/jsscope.cpp:493

RESOLVED FIXED in mozilla12

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla12
x86
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 583759 [details]
shell testcase, unpack, chdir and run main.js with options "-n -m"

The attached test asserts on mozilla-central revision f98c57415d8d (options -m -n). I assume this test is fragile across architectures (use 32 bit) because it's an OOM (with gcparam though).
Created attachment 584132 [details] [diff] [review]
patch

The return value of the hashify() call when converting objects to dictionary mode was being ignored.
Assignee: general → bhackett1024
Attachment #584132 - Flags: review?(luke)

Updated

5 years ago
Attachment #584132 - Flags: review?(luke) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/cf4feabb94cc
https://hg.mozilla.org/mozilla-central/rev/cf4feabb94cc
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
You need to log in before you can comment on or make changes to this bug.