Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit /IonCaches.cpp:427

RESOLVED FIXED in Firefox 41

Status

()

RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: cbook, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion})

unspecified
mozilla41
Unspecified
All
assertion
Points:
---

Firefox Tracking Flags

(firefox41 fixed)

Details

(URL)

Attachments

(3 attachments)

(Reporter)

Description

3 years ago
found via Bughunter and reproduced on a Windows 7 Trunk debug build based on m-c tip

Steps to reproduce:

-> Load http://www.alibaba.com/premium/razor_wire.html?uptime=20140803&ptsid=1012000053677109&crea=50264396180&plac=&netw=s&device=c&ptscode=0110202010010001
--> Assertion on load:
Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit
/IonCaches.cpp:427
(Reporter)

Comment 1

3 years ago
Created attachment 8622451 [details]
bughunter stack
(Reporter)

Comment 2

3 years ago
Hey Brian, could take a look at this bug, thanks
Flags: needinfo?(bhackett1024)
(Reporter)

Comment 3

3 years ago
Created attachment 8622467 [details]
windbg information
(Assignee)

Comment 4

3 years ago
Created attachment 8622479 [details] [diff] [review]
patch

There isn't any security risk here, though the Ion IC could potentially behave incorrectly.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8622479 - Flags: review?(jdemooij)
(Assignee)

Updated

3 years ago
Group: core-security

Updated

3 years ago
Attachment #8622479 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/01f7029384cb
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox41: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in before you can comment on or make changes to this bug.