Closed
Bug 533254
Opened 15 years ago
Closed 15 years ago
Assertion failure: sprop2 == sprop
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.3a1
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | alpha1+ |
People
(Reporter: bc, Assigned: brendan)
References
()
Details
(Keywords: assertion, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
(deleted),
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
1. http://www.jpost.com/ 2. Assertion failure: sprop2 == sprop, at /work/mozilla/builds/1.9.3/mozilla/js/src/jsops.cpp:3575
|
Assignee | |
Comment 1•15 years ago
|
||
Attachment #416508 -
Flags: review?(jorendorff)
|
|
Assignee | |
Updated•15 years ago
|
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.3a1
|
||
Updated•15 years ago
|
Attachment #416508 -
Flags: review?(jorendorff) → review+
|
|
Assignee | |
Comment 2•15 years ago
|
||
The useless |var proto = {p8:8};| left-over turns out to be essential to the testcase, to provoke property cache collisions that help repro the bug. Analysis here (perma-link):
http://pastebin.mozilla.org/689381
Filed bug 533584 on improving PROPERTY_CACHE_HASH.
/be|
|
Assignee | |
Comment 3•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/2514d4a1af7d /be
Whiteboard: fixed-in-tracemonkey
|
||
Comment 5•15 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/2514d4a1af7d
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
|
|
||
Updated•15 years ago
|
blocking2.0: --- → alpha1
You need to log in
before you can comment on or make changes to this bug.
Description
•