Closed
Bug 643250
Opened 13 years ago
Closed 13 years ago
TI: Crash [@ js::types::TypeObject::storeToInstances] or "Assertion failure: JSID_IS_STRING(id)," or "Assertion failure: JSID_BITS(id) == JSID_TYPE_VOID,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 643284
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, crash, testcase)
Crash Data
Attachments
(1 file)
4.55 KB,
text/plain
|
Details |
o = [''] Uint8ClampedArray.b function f4() { _someglobal_ = o try { eval() } catch(e) {} _someglobal_['__proto_' + '_'] = null } for (var i = 0; i < 10; i++) { f4() gc() } asserts or crashes js debug shell on JM changeset 5ce2f7a90286 with -m, -a and -n [@ js::types::TypeObject::storeToInstances] or Assertion failure: JSID_IS_STRING(id), or Assertion failure: JSID_BITS(id) == JSID_TYPE_VOID, Pass this in as a CLI argument to reproduce. The error messages rotate among each other.
Reporter | ||
Comment 1•13 years ago
|
||
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Updated•13 years ago
|
Crash Signature: [@ js::types::TypeObject::storeToInstances]
You need to log in
before you can comment on or make changes to this bug.
Description
•