Assertion failure: isNumber(), at ./dist/include/js/Value.h:1059 through DefinePropertyOnArray

RESOLVED FIXED in mozilla23

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: Waldo)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla23
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on mozilla-central revision 05533d50f2f7 (no options required):


arr = Object.defineProperty([], "length", { value: 0, writable: false });
Object.defineProperty(arr, "length", { value: '' });
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 1

5 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   129833:8eac2a78a791
user:        Jeff Walden
date:        Tue Mar 19 17:12:06 2013 -0700
summary:     Bug 858381 - Implement non-writable array lengths, and add a boatload of tests.  r=jorendorff and r=bhackett for the major parts of this, r=jandem for the methodjit changes, r=jimb on a debugger test change, r=nmatsakis for the parallel test.  (More details available in the bug, where individual components of the fix were separately reviewed.)

This iteration took 118.738 seconds to run.
(Reporter)

Comment 2

5 years ago
Waldo, mind taking a look based on comment 1?
(Assignee)

Comment 3

5 years ago
Created attachment 743118 [details] [diff] [review]
Patch and test

Stupid mistake, easy fix.
Attachment #743118 - Flags: review?(bhackett1024)
(Assignee)

Updated

5 years ago
Assignee: general → jwalden+bmo
(Assignee)

Comment 4

5 years ago
Comment on attachment 743118 [details] [diff] [review]
Patch and test

Actually, no, this might be wrong.
Attachment #743118 - Flags: review?(bhackett1024)
(Assignee)

Comment 5

5 years ago
Created attachment 743187 [details] [diff] [review]
Actually correct patch/tests

Array length semantics are crazy.
Attachment #743187 - Flags: review?(bhackett1024)
(Assignee)

Updated

5 years ago
Attachment #743118 - Attachment is obsolete: true
Attachment #743187 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 6

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/ed6ed6288ee2
OS: Linux → All
Hardware: x86 → All
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.