Closed
Bug 1174712
Opened 9 years ago
Closed 9 years ago
Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit /IonCaches.cpp:427
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla41
| Tracking | Status | |
|---|---|---|
| firefox41 | --- | fixed |
People
(Reporter: cbook, Assigned: bhackett1024)
References
()
Details
(Keywords: assertion)
Attachments
(3 files)
found via Bughunter and reproduced on a Windows 7 Trunk debug build based on m-c tip Steps to reproduce: -> Load http://www.alibaba.com/premium/razor_wire.html?uptime=20140803&ptsid=1012000053677109&crea=50264396180&plac=&netw=s&device=c&ptscode=0110202010010001 --> Assertion on load: Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit /IonCaches.cpp:427
|
Reporter | |
Comment 1•9 years ago
|
||
|
|
Reporter | |
Comment 2•9 years ago
|
||
Hey Brian, could take a look at this bug, thanks
Flags: needinfo?(bhackett1024)
|
|
Reporter | |
Comment 3•9 years ago
|
||
|
Assignee | |
Comment 4•9 years ago
|
||
There isn't any security risk here, though the Ion IC could potentially behave incorrectly.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8622479 -
Flags: review?(jdemooij)
|
|
Assignee | |
Updated•9 years ago
|
Group: core-security
|
||
Updated•9 years ago
|
Attachment #8622479 -
Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/01f7029384cb
Status: NEW → RESOLVED
Closed: 9 years ago
status-firefox41:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in
before you can comment on or make changes to this bug.
Description
•