Closed
Bug 698899
Opened 13 years ago
Closed 13 years ago
TI: "Assertion failure: type->canProvideEmptyShape(clasp),"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
|
(deleted),
text/plain
|
Details |
o = evalcx("lazy").__proto__
gc()
try {
o.watch()
} catch (e) {}
o.constructor()
asserts js debug shell on JM changeset f951e9151626 with -n at Assertion failure: type->canProvideEmptyShape(clasp),
Related to bug 698150 ?
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 78127:40f829990c82
user: Brian Hackett
date: Fri Oct 07 20:09:09 2011 -0700
summary: Move JSObject::newType to a hashtable, bug 684410.
|
Reporter | |
Comment 1•13 years ago
|
||
This was likely fixed by bug 684507.
autoBisect shows this is probably related to the following changeset:
The first good revision is:
changeset: 79618:3e9445901e8b
user: Brian Hackett
date: Wed Nov 02 13:34:19 2011 -0700
summary: Remove JSObject::isNewborn, refactor object creation code, bug 684507.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
||
Updated•13 years ago
|
Flags: in-testsuite?
|
||
Comment 2•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite? → in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•