Closed Bug 928268 Opened 7 years ago Closed 7 years ago
"Assertion failure: !uninlined
Is Proxy()" with ion eager in browser
Do you have a regression range?
Based on the stack it's probably a regression from the recent TI changes.
This assert is bogus, getProto() will return a 0x1 JSObject* for proxies with a lazy prototype, but this call site will immediately coerce that JSObject* into a TaggedProto and callers will handle the 0x1 correctly.
Assignee: nobody → bhackett1024
Attachment #819035 - Flags: review?(jdemooij)
Bogus assert, not s-s.
Attachment #819035 - Flags: review?(jdemooij) → review+
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.