Closed Bug 388151 Opened 19 years ago Closed 18 years ago

Assertion failure: offsetInArena < GC_THINGS_SIZE in js1_7/extensions/regress-355512.js

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: bc, Assigned: igor)

References

Details

(Keywords: regression)

js1_7/extensions/regress-355512.js in debug js shell on linux. bug 380469 is a candidate I believe. BUGNUMBER: 355512 STATUS: Do not crash with generator arguments before 36928, after 36928, break 088c4000 Assertion failure: offsetInArena < GC_THINGS_SIZE, at jsgc.c:514 Trace/breakpoint trap
Flags: in-testsuite+
Note on macppc this test asserts as Assertion failure: fp->argsobj, at jsfun.c:443
This is indeed a regression.
Assignee: general → igor
fixed by Bug 380469 comment 25
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
verified fixed 1.9.0 linux/mac*/windows
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.