Closed Bug 630366 Opened 14 years ago Closed 14 years ago

Assertion failure: obj->nativeContains(*shape), at ../methodjit/StubCalls.cpp:180

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
All
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 631723
Tracking Flags:
Tracking Status
blocking2.0 --- final+

People

(Reporter: jandem, Unassigned)

References

Details

(4 keywords, Whiteboard: [sg:high (if not a dupe)][softblocker])

This snippet fails with -m: -- var o = {}; for(var i=0; i<5; i++) { o.p = 2; o.watch("p", function() { }); o.p = 2; delete o.p; } -- Assertion failure: obj->nativeContains(*shape), at ../methodjit/StubCalls.cpp:180 Looks a lot like bug 627984, but I see this only with -m, so I'm filing it as a separate bug.
Blocks: 630996
blocking2.0: --- → ?
Keywords: assertion
Depends on: 627984
Whiteboard: [sg:high (if not a dupe)]
It looks like it's probably caused by the same set of problems as bug 627984. I don't think anything particularly bad happens with it in this case, mostly just skipping a watchpoint when it is created again after being deleted. Might want to have dvander verify that.
blocking2.0: ? → final+
Whiteboard: [sg:high (if not a dupe)] → [sg:high (if not a dupe)][softblocker]
The patch in bug 631723 fixes this, so duping forward.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.