1193167 - crash due to Assertion failure: callInfo.argc() == 0, at js/src/jit/MCallOptimize.cpp:3062

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Spandan Veggalam]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0
Build ID: 20150629114049

Steps to reproduce:

mozilla-central revision 892594bdad30 (build with: --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --enable-debug) 

(Flags: --ion-eager)


var isConstructing = getSelfHostedValue("_IsConstructing");
for (var i = 0; i < 40; i++) {
    isConstructing('aaaaa');
}



Actual results:

Assertion failure: callInfo.argc() == 0, at js/src/jit/MCallOptimize.cpp:3062

Comment 1

[Jan de Mooij [:jandem]]

Thanks for the bug reports! As Jeff explained in bug 1192399 comment 1, this failure is expected though: getSelfHostedValue is an internal testing function that's not fuzzing safe.

Please use the --fuzzing-safe shell flag to hide getSelfHostedValue and similar functions. Thanks!