| 1328251
|
|
GC races involving the self-hosting zone and workers
|
Core
|
JavaScript: GC
|
jcoppeard
|
RESO
|
FIXE
|
2017-08-28
|
| 1331058
|
|
Definite Properties Analysis doesn't detect |this| escaping via CallObjects
|
Core
|
JavaScript Engine: J
|
jdemooij
|
RESO
|
FIXE
|
2017-08-28
|
| 1328834
|
|
Assertion failure: hasScript(), at js/src/jsfun.h:459 with GC
|
Core
|
JavaScript Engine
|
jdemooij
|
VERI
|
FIXE
|
2023-12-06
|
| 1322315
|
|
Assertion failure: Integer input should be lower or equal than Upperbound., at js/src/jit/MacroAssembler.cpp:1597
|
Core
|
JavaScript Engine
|
nobody
|
VERI
|
FIXE
|
2023-12-06
|
| 1325938
|
|
Baseline GetName ICs expose the window object (not the WindowProxy)
|
Core
|
JavaScript Engine
|
evilpies
|
VERI
|
FIXE
|
2017-08-28
|
| 1322420
|
|
[@ js::Scope::environmentChainLength] or Assertion failure: allocated(), at js/src/gc/Heap.h:591
|
Core
|
JavaScript Engine
|
jcoppeard
|
VERI
|
FIXE
|
2023-12-06
|
| 1285833
|
|
Assertion failure: index < obj.length(), at js/src/vm/TypedArrayObject.cpp:2163
|
Core
|
JavaScript Engine
|
jwalden
|
VERI
|
FIXE
|
2017-11-02
|
| 1285960
|
|
Assertion failure: byteOffset + byteLength <= arrayBuffer->byteLength(), at js/src/vm/TypedArrayObject.cpp:1418
|
Core
|
JavaScript Engine
|
jwalden
|
VERI
|
FIXE
|
2024-05-30
|
| 1325877
|
|
Compartment mismatch in nsDOMConstructor::HasInstance
|
Core
|
DOM: Core & HTML
|
jwalden
|
VERI
|
FIXE
|
2019-03-13
|