Closed Bug 1174712 Opened 6 years ago Closed 6 years ago

Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit /IonCaches.cpp:427

Categories

(Core :: JavaScript Engine, defect)

Unspecified
All
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla41
Tracking Status
firefox41 --- fixed

People

(Reporter: cbook, Assigned: bhackett1024)

References

()

Details

(Keywords: assertion)

Attachments

(3 files)

found via Bughunter and reproduced on a Windows 7 Trunk debug build based on m-c tip

Steps to reproduce:

-> Load http://www.alibaba.com/premium/razor_wire.html?uptime=20140803&ptsid=1012000053677109&crea=50264396180&plac=&netw=s&device=c&ptscode=0110202010010001
--> Assertion on load:
Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit
/IonCaches.cpp:427
Attached file bughunter stack
Hey Brian, could take a look at this bug, thanks
Flags: needinfo?(bhackett1024)
Attached file windbg information
Attached patch patchSplinter Review
There isn't any security risk here, though the Ion IC could potentially behave incorrectly.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8622479 - Flags: review?(jdemooij)
Group: core-security
Attachment #8622479 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/01f7029384cb
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in before you can comment on or make changes to this bug.