Closed
Bug 744266
Opened 13 years ago
Closed 13 years ago
IonMonkey: Crash [@ getClass] or "Assertion failure: isObject(),"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 749048
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, crash, testcase, Whiteboard: [jsbugmon:update,ignore])
Crash Data
Attachments
(1 file)
|
2.97 KB,
text/plain
|
Details |
a = b = function() {}
Object.defineProperty(this, "c", {
get: function() {
Number(a)
}
})
b.toString = (function() {
for (var p in Uint8ClampedArray(2)) {
b + ''
}
})
for (p in c) {}
asserts js debug shell on IonMonkey changeset 830e73261538 with --ion and -n at Assertion failure: isObject(), and crashes js opt shell at getClass
Tested 32-bit builds in Ubuntu Linux, and with --enable-more-deterministic.
|
||
Updated•13 years ago
|
Whiteboard: [jsbugmon:update]
|
|
||
Comment 1•13 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1161f2520e9b).
|
|
||
Updated•13 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
|
||
Comment 2•13 years ago
|
||
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•