Closed Bug 836563 Opened 11 years ago Closed 11 years ago

"Assertion failure: JSID_IS_INT(obj->lastProperty()->propid())"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 836623

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, regression, testcase) 

var x = {};
Object.defineProperty(x, 0, { configurable: true, value: null });
x.p = 0
Object.defineProperty(x, 0, { value: 2 });


Assertion failure: JSID_IS_INT(obj->lastProperty()->propid()), at jsobj.cpp:2551

The first bad revision is:
changeset:   7d45649de683
user:        Brian Hackett
date:        Tue Jan 29 19:50:41 2013 -0700
summary:     Bug 835102 - Convert sufficiently sparse objects back to using dense elements, r=billm.
Fixed by the patch in bug 836623 (these are different bugs, but this is just a bogus assertion).
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
A testcase for this bug was already added in the original bug (bug 836623).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.