found via Bughunter and reproduced on a Windows 7 Trunk debug build based on m-c tip Steps to reproduce: -> Load http://www.alibaba.com/premium/razor_wire.html?uptime=20140803&ptsid=1012000053677109&crea=50264396180&plac=&netw=s&device=c&ptscode=0110202010010001 --> Assertion on load: Assertion failure: !pobj->isSingleton(), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/jit /IonCaches.cpp:427
Hey Brian, could take a look at this bug, thanks
Created attachment 8622479 [details] [diff] [review] patch There isn't any security risk here, though the Ion IC could potentially behave incorrectly.
Assignee: nobody → bhackett1024
Attachment #8622479 - Flags: review?(jdemooij)
Attachment #8622479 - Flags: review?(jdemooij) → review+
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox41: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in before you can comment on or make changes to this bug.