Closed Bug 420880 Opened 16 years ago Closed 16 years ago

Assertion failure: fp, in jsobj.c

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
1.8 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: bc, Assigned: igor)

References

Details

(Keywords: regression, testcase, verified1.8.1.13, Whiteboard: [sg:nse]) 

js1_7/extensions/regress-353249.js,
js1_7/regress/regress-352797-02.js

Assertion failure: fp, at js/src/jsobj.c:2004

sensitive since bug 416705 is.
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.8.1.13?
/cvsroot/mozilla/js/tests/public-failures.txt,v  <--  public-failures.txt
new revision: 1.47; previous revision: 1.46

blocking on regression from security fix.

Igor: is this easy to fix, or would it be better to back out 416705 for this branch release?

Yay for extensive tests!
Flags: blocking1.8.1.13? → blocking1.8.1.13+
Whiteboard: [sg:nse]
(In reply to comment #2)
> Igor: is this easy to fix, or would it be better to back out 416705 for this
> branch release?

I suggest to back out bug 416705. I will have the proper and very targeted fix later today. The problem is that on the branch PutBlockObjects does not stop at the right moment.
fixed by backing out of patch in bug 416705

/cvsroot/mozilla/js/tests/public-failures.txt,v  <--  public-failures.txt
new revision: 1.48; previous revision: 1.47
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
verified fixed 1.8.1.13
Keywords: fixed1.8.1.13 → verified1.8.1.13
Status: RESOLVED → VERIFIED
Flags: blocking1.8.0.15+
js1.7 not applicable on 1.8.0 branch.
Flags: blocking1.8.0.15+ → blocking1.8.0.15-
Group: security
You need to log in before you can comment on or make changes to this bug.