Closed
Bug 566781
Opened 15 years ago
Closed 15 years ago
"Assertion failure: JSVAL_IS_OBJECT(v)" with empty harmony:proxy, GC
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: gal)
References
Details
(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
1.50 KB,
patch
|
shaver
:
review+
|
Details | Diff | Splinter Review |
var w = Proxy.createFunction({}, function(){});
gc();
Assertion failure: JSVAL_IS_OBJECT(v), at ../jsapi.h:183
|
Assignee | |
Comment 1•15 years ago
|
||
Assignee: general → gal
|
||
Comment 2•15 years ago
|
||
Comment on attachment 446131 [details] [diff] [review]
patch
r=shaver
Attachment #446131 -
Flags: review+
|
|
Assignee | |
Comment 3•15 years ago
|
||
Regressor patch was in the tree only for a few minutes without a fix. Not exploitable.
http://hg.mozilla.org/tracemonkey/rev/0d87cf478f15
Group: core-security
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
|
||
Comment 4•15 years ago
|
||
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•