Closed Bug 755294 Opened 12 years ago Closed 12 years ago

Assertion failure: isDenseArray(), at vm/ObjectImpl-inl.h:74

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 731642

People

(Reporter: decoder, Unassigned)

Details

(Keywords: assertion, testcase, Whiteboard: [js:t] [jsbugmon:update,ignore]) 

The following test asserts on mozilla-central revision c758cc9b60e5 (options -m -n -a):


function setterFunction(v) { called = true; }
function getterFunction(v) {
  this.setterFunction = 11;
}
Object.defineProperty(Array.prototype, 1,
  { get: getterFunction, set: setterFunction });
  [1,,].pop();
Whiteboard: js-triage-needed [jsbugmon:update] → [js:t][jsbugmon:update]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision efbb6480e98e).
Whiteboard: [js:t][jsbugmon:update] → [js:t] [jsbugmon:update,ignore]
Dup of bug 731642 probably?
Whiteboard: [js:t] [jsbugmon:update,ignore] → [js:t] [jsbugmon:update,bisectfix]
Whiteboard: [js:t] [jsbugmon:update,bisectfix] → [js:t] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4d59eb5ac2c6).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   96519:f41d4b18acaa
user:        Jon Coppeard
date:        Tue Jun 12 17:04:33 2012 -0400
summary:     Bug 731642 - Assertion failure: isDenseArray(), at ../jsobjinlines.h:504. r=Waldo
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
A testcase for this bug was already added in the original bug (bug 731642).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.