Bug 469313 - TM: crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) (r=gal).

This commit is contained in:
Brendan Eich 2008-12-13 17:32:44 -08:00
parent 41c9e25f93
commit 2bbb1f2b7b

View File

@ -231,7 +231,8 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj, jsuword kshape,
#endif
SCOPE_MAKE_UNIQUE_SHAPE(cx, scope);
SCOPE_SET_BRANDED(scope);
kshape = scope->shape;
if (OBJ_SCOPE(obj) == scope)
kshape = scope->shape;
}
vword = JSVAL_OBJECT_TO_PCVAL(v);
break;