Closed Bug 636889 Opened 13 years ago Closed 13 years ago

MethodJIT: Crash // Assertion failure: !cx->iterValue.isMagic(JS_NO_ITER_VALUE)

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 636879
Tracking Status
status1.9.2 --- unaffected
status1.9.1 --- unaffected

People

(Reporter: decoder, Unassigned)

Details

(Keywords: assertion, crash, testcase)

Attachments

(1 file)

The attached testcase (shell testcase, unpack, chdir and run "js -j -m -a main.js") causes the current TM tip to crash. The original testcase produced the assertion 

Assertion failure: !cx->iterValue.isMagic(JS_NO_ITER_VALUE), at jsiter.cpp:1018

but now I'm only getting a segmentation fault.

Maybe related to 636879.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: