The following testcase asserts on mozilla-central revision 1eb382609c2d (run with --ion-eager): this.__defineSetter__("customNative", unescape);
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 125296:f7e1b97dcc73 user: Jan de Mooij date: Mon Mar 18 22:34:34 2013 +0100 summary: Bug 851109 - Add NAME IC for invoking getters on the global object. r=djvj This iteration took 139.998 seconds to run.
Jandem, can you take a look based on comment 1? :)
Created attachment 747279 [details] [crash-signature] Machine-readable crash signature
Created attachment 774542 [details] [diff] [review] Patch I added a customNative property to the shell's global, but this asserts if we don't pass the JSPROP_SHARED flag to JS_DefineProperty. Only affects the shell.
4 years ago