Closed Bug 755294 Opened 14 years ago Closed 13 years ago

Assertion failure: isDenseArray(), at vm/ObjectImpl-inl.h:74

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 731642

People

(Reporter: decoder, Unassigned)

Details

(Keywords: assertion, testcase, Whiteboard: [js:t] [jsbugmon:update,ignore])

The following test asserts on mozilla-central revision c758cc9b60e5 (options -m -n -a): function setterFunction(v) { called = true; } function getterFunction(v) { this.setterFunction = 11; } Object.defineProperty(Array.prototype, 1, { get: getterFunction, set: setterFunction }); [1,,].pop();
Whiteboard: js-triage-needed [jsbugmon:update] → [js:t][jsbugmon:update]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision efbb6480e98e).
Whiteboard: [js:t][jsbugmon:update] → [js:t] [jsbugmon:update,ignore]
Dup of bug 731642 probably?
Whiteboard: [js:t] [jsbugmon:update,ignore] → [js:t] [jsbugmon:update,bisectfix]
Whiteboard: [js:t] [jsbugmon:update,bisectfix] → [js:t] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4d59eb5ac2c6). JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 96519:f41d4b18acaa user: Jon Coppeard date: Tue Jun 12 17:04:33 2012 -0400 summary: Bug 731642 - Assertion failure: isDenseArray(), at ../jsobjinlines.h:504. r=Waldo
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
A testcase for this bug was already added in the original bug (bug 731642).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.