Closed Bug 867082 Opened 8 years ago Closed 8 years ago
Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40), at vm/Shape
The following testcase asserts on mozilla-central revision 1eb382609c2d (run with --ion-eager): this.__defineSetter__("customNative", unescape);
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 125296:f7e1b97dcc73 user: Jan de Mooij date: Mon Mar 18 22:34:34 2013 +0100 summary: Bug 851109 - Add NAME IC for invoking getters on the global object. r=djvj This iteration took 139.998 seconds to run.
Jandem, can you take a look based on comment 1? :)
8 years ago
8 years ago
I added a customNative property to the shell's global, but this asserts if we don't pass the JSPROP_SHARED flag to JS_DefineProperty. Only affects the shell.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #774542 - Flags: review?(jwalden+bmo)
Attachment #774542 - Flags: review?(jwalden+bmo) → review+
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.