Closed
Bug 416460
Opened 17 years ago
Closed 17 years ago
"Assertion failure: SCOPE_GET_PROPERTY(OBJ_SCOPE(pobj), ATOM_TO_JSID(atom))"
Categories
(Core :: JavaScript Engine, defect, P1)
Tracking
()
VERIFIED
FIXED
mozilla1.9beta4
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
|
(deleted),
patch
|
shaver
:
review+
|
Details | Diff | Splinter Review |
This script triggers an assertion failure in debug jsshell and debug Firefox. In opt jsshell, nothing bad seems to happen. The assertion is part of code added in bug 365851.
/a/.__proto__.__proto__ = { "2": 3 };
var b = /b/;
b["2"];
b["2"];
Assertion failure: SCOPE_GET_PROPERTY(OBJ_SCOPE(pobj), ATOM_TO_JSID(atom)), at jsinterp.c:333
Flags: blocking1.9?
|
Assignee | |
Comment 1•17 years ago
|
||
May as well share the wealth from jsobj.c via jsobj.h, use it to avoid the bogus assertion.
/be
|
|
Assignee | |
Comment 2•17 years ago
|
||
This is only a bogus assertion. Nothing goes wrong in release builds.
/be
Severity: critical → major
Flags: blocking1.9? → blocking1.9+
|
|
Assignee | |
Updated•17 years ago
|
Priority: -- → P1
Target Milestone: --- → mozilla1.9beta4
Comment on attachment 302432 [details] [diff] [review]
fix bogus assertion
r=shaver
Attachment #302432 -
Flags: review?(shaver) → review+
|
|
Assignee | |
Comment 4•17 years ago
|
||
Fixed:
js/src/jsinterp.c 3.420
js/src/jsobj.c 3.427
js/src/jsobj.h 3.84
/be
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
||
Comment 5•17 years ago
|
||
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-416460.js,v <-- regress-416460.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•