961998 - assert triggered in jsobj.cpp:2432

Status: RESOLVED DUPLICATE of bug 961969

(Core :: JavaScript Engine, defect)

Description

[Daniel Stenberg [:bagder]]

With a mozilla-central built fresh from mercurial just now, I go to this URL:

  http://shop.lenovo.com/us/en/laptops/thinkpad/w-series/w540/

I get a crash. 100% repeatable it seems for the half dozen times I tried it. Debugging the crash I got this assert log:

Program received signal SIGSEGV, Segmentation fault.
0x00007f6eb7c878b9 in JSObject::setLastProperty (cx=cx@entry=0x7f6e44660390, 
    obj=obj@entry=..., shape=shape@entry=...)
    at /home/daniel/src/mozilla-central/js/src/../../js/src/jsobj.cpp:2432
2432        JS_ASSERT(shape->numFixedSlots() == obj->numFixedSlots());
(gdb) p shape
$1 = {<js::HandleBase<js::Shape*>> = {<No data fields>}, ptr = 0x7fff7418dfa0}
(gdb) p obj
$2 = {<js::HandleBase<JSObject*>> = {<No data fields>}, ptr = 0x7fff7418e7a0}

Let me know if there's anything else I can do or provide.

Comment 1

[Luke Wagner [:luke]]

Thanks for reporting (and running debug builds!).  I verified that the patch in bug 961969 fixes this.