Closed Bug 420880 Opened 12 years ago Closed 12 years ago

Assertion failure: fp, in jsobj.c

Categories

(Core :: JavaScript Engine, defect)

1.8 Branch
x86
All
defect
Not set

Tracking

()

VERIFIED FIXED

People

(Reporter: bc, Assigned: igor)

References

Details

(Keywords: regression, testcase, verified1.8.1.13, Whiteboard: [sg:nse])

js1_7/extensions/regress-353249.js,
js1_7/regress/regress-352797-02.js

Assertion failure: fp, at js/src/jsobj.c:2004

sensitive since bug 416705 is.
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.8.1.13?
/cvsroot/mozilla/js/tests/public-failures.txt,v  <--  public-failures.txt
new revision: 1.47; previous revision: 1.46
blocking on regression from security fix.

Igor: is this easy to fix, or would it be better to back out 416705 for this branch release?

Yay for extensive tests!
Flags: blocking1.8.1.13? → blocking1.8.1.13+
Whiteboard: [sg:nse]
(In reply to comment #2)
> Igor: is this easy to fix, or would it be better to back out 416705 for this
> branch release?

I suggest to back out bug 416705. I will have the proper and very targeted fix later today. The problem is that on the branch PutBlockObjects does not stop at the right moment.
fixed by backing out of patch in bug 416705

/cvsroot/mozilla/js/tests/public-failures.txt,v  <--  public-failures.txt
new revision: 1.48; previous revision: 1.47
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
verified fixed 1.8.1.13
Status: RESOLVED → VERIFIED
Flags: blocking1.8.0.15+
js1.7 not applicable on 1.8.0 branch.
Flags: blocking1.8.0.15+ → blocking1.8.0.15-
Group: security
You need to log in before you can comment on or make changes to this bug.