Bug 469313 - TM: crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) (r=gal).
authorBrendan Eich <brendan@mozilla.org>
Sat, 13 Dec 2008 17:30:04 -0800
changeset 23065 3c3921f30981f8e780d669688b72ea768a5524ba
parent 23064 e905fe64c1b279d2089e4238e8bdb9c58cb122bf
child 23067 7a24f8922f4b3064a07eaffe7ba43d7f4a0f6b7c
push id4346
push userrsayre@mozilla.com
push dateFri, 26 Dec 2008 01:26:36 +0000
treeherdermozilla-central@8eb5a5b83a93 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersgal
bugs469313
milestone1.9.2a1pre
Bug 469313 - TM: crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) (r=gal).
js/src/jsinterp.cpp
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -226,17 +226,18 @@ js_FillPropertyCache(JSContext *cx, JSOb
                             pobj, LOCKED_OBJ_GET_CLASS(pobj)->name,
                             JSVAL_TO_OBJECT(v),
                             JS_GetFunctionName(GET_FUNCTION_PRIVATE(cx,
                                                  JSVAL_TO_OBJECT(v))),
                             kshape);
 #endif
                         SCOPE_MAKE_UNIQUE_SHAPE(cx, scope);
                         SCOPE_SET_BRANDED(scope);
-                        kshape = scope->shape;
+                        if (OBJ_SCOPE(obj) == scope)
+                            kshape = scope->shape;
                     }
                     vword = JSVAL_OBJECT_TO_PCVAL(v);
                     break;
                 }
             }
         }
 
         /* If getting a value via a stub getter, we can cache the slot. */