Closed
Bug 783590
Opened 12 years ago
Closed 12 years ago
IonMonkey: "Assertion failure: !isOwn,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Assigned: efaust)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(2 files)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
var glob = this;
var arr = [];
Object.defineProperty(arr, 0, {
get: (function() {
glob.__proto__;
})
});
this.watch("s", function() {});
try {
arr.pop();
} catch (e) {}
arr.pop();
asserts js debug shell on IonMonkey changeset d794f23798f4 with --no-jm and --ion-eager at Assertion failure: !isOwn,
(not sure if this is correct):
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 101425:adb60cc7b150
parent: 100948:5d1128ed64af
parent: 101424:9b876829ed32
user: David Anderson
date: Wed Jul 18 19:02:32 2012 -0700
summary: Merge from mozilla-central.
|
Assignee | |
Comment 1•12 years ago
|
||
The bug was that we were trying to only deal with Object.watch on setters, but because of TI limitations, we need to refuse getters as well in the presence of watched objects on the prototype chain.
Attachment #652968 -
Flags: review?(sstangl)
|
|
Assignee | |
Updated•12 years ago
|
Assignee: general → efaustbmo
Status: NEW → ASSIGNED
|
||
Updated•12 years ago
|
Attachment #652968 -
Flags: review?(sstangl) → review+
|
|
Assignee | |
Comment 2•12 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
|
||
Comment 3•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug783590.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•