665273 - Crash [@ GetElement] or "Assertion failure: index >= 0,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(Array(2415838199)).reduceRight(function(){})

crashes js opt shell on JM changeset 9ff00d53b5a5 without any CLI arguments at GetElement and asserts js debug shell at Assertion failure: index >= 0,

May be related to bug 663468 or bug 664009 ?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Also reproduces on TM changeset e59b1d2a2f79.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   26356:7f7722d3a2dc
user:        Jeff Walden
date:        Mon Jan 12 13:07:48 2009 -0800
summary:     Bug 465980 - Some array methods don't work right on ginormous arrays.  r=brendan

Comment 3

[Jeff Walden [:Waldo]]

I didn't land the fix for bug 664009 in TM, only in m-c and a bunch of beta and release branches.  I'm pretty sure this goes away with a m-c->TM merge.

Comment 6

[Doug Turner (:dougt)]

sorry for the noise.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #3)
> I didn't land the fix for bug 664009 in TM, only in m-c and a bunch of beta
> and release branches.  I'm pretty sure this goes away with a m-c->TM merge.

Confirmed to be fixed in a later TM changeset 0428dbdf3d58.