Closed Bug 1258349 Opened 8 years ago Closed 8 years ago

Assertion failure: size_t(opId.id()) <= 0xffui8, at CacheIR.h:150

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla48
Tracking Status
firefox48 --- fixed

People

(Reporter: cbook, Assigned: jandem)

References

()

Details

(Keywords: assertion)

Attachments

(2 files)

Assertion failure: size_t(opId.id()) <= 0xffui8, at c:\Users\mozilla\debug-build
s\mozilla-central\js\src\jit/CacheIR.h:150

Steps to reproduce:

--> Load http://www.rentalcars.com/partners/integrations/stand-alone-app/?affiliateCode=jetstar&css=true&template=jetstar&forwardUrl=jetstar.rentalcars.com&preflang=en&prefcurrency=&cor=gb

note: you might click ok on a slow script warning
--> Assertion

tested with todays m-c and windows 7 trunk debug build

Regression of bug Bug 1255352 ?
Thanks. This is a bogus assert, will post a patch soon.
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
Bogus assert.

This website must be creating some weird proto chains.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8732838 - Flags: review?(efaustbmo)
Blocks: 1255352
jsfunfuzz found this too (looking through backlog), but the testcase in comment 2 is very compact and concise, so I won't be filing a new bug.
Comment on attachment 8732838 [details] [diff] [review]
Patch

Review of attachment 8732838 [details] [diff] [review]:
-----------------------------------------------------------------

Oh, indeed. Thanks for the static_assert.
Attachment #8732838 - Flags: review?(efaustbmo) → review+
https://hg.mozilla.org/mozilla-central/rev/f76214d65f75
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
You need to log in before you can comment on or make changes to this bug.