Closed Bug 601400 Opened 9 years ago Closed 9 years ago

JM: "Assertion failure: offset < script->length,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: gkw, Assigned: dvander)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

eval("\
    function NaN() {}\
    for(w in s) {}\
")

asserts js debug shell on TM changeset 0230a9e80c1f with -m at Assertion failure: offset < script->length,
blocking2.0: --- → ?
This seems to have occurred since the advent of JM although I'm really not sure..
blocking2.0: ? → betaN+
Attached patch fixSplinter Review
bogus assert, you can throw inside script->main
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #489582 - Flags: review?(dmandelin)
Attachment #489582 - Flags: review?(dmandelin) → review+
http://hg.mozilla.org/mozilla-central/rev/9156ba8a843d
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug601400.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.