"ASSERTION: invalid array index" with DOMSVGLengthList.removeItem

RESOLVED INCOMPLETE

Status

()

--
critical
RESOLVED INCOMPLETE
8 years ago
8 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

(Blocks: 1 bug, {assertion})

Trunk
x86
Mac OS X
assertion
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

8 years ago
Created attachment 500719 [details]
stack trace

Hit this with crossfuzz, don't know how to reproduce.

###!!! ASSERTION: invalid array index: 'i < Length()', file nsTArray.h, line 451
Does this still happen? I suspect jwatt's fixes to LengthList should have sorted this.
(Reporter)

Updated

8 years ago
Status: UNCONFIRMED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.