"Assertion failure: JSID_IS_INT(obj->lastProperty()->propid())"

RESOLVED DUPLICATE of bug 836623

Status

()

--
critical
RESOLVED DUPLICATE of bug 836623
6 years ago
6 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
var x = {};
Object.defineProperty(x, 0, { configurable: true, value: null });
x.p = 0
Object.defineProperty(x, 0, { value: 2 });


Assertion failure: JSID_IS_INT(obj->lastProperty()->propid()), at jsobj.cpp:2551

The first bad revision is:
changeset:   7d45649de683
user:        Brian Hackett
date:        Tue Jan 29 19:50:41 2013 -0700
summary:     Bug 835102 - Convert sufficiently sparse objects back to using dense elements, r=billm.
Fixed by the patch in bug 836623 (these are different bugs, but this is just a bogus assertion).
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 836623
A testcase for this bug was already added in the original bug (bug 836623).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.