Closed
Bug 684474
Opened 14 years ago
Closed 14 years ago
Assertion failure: comp->freeLists.lists[thingKind].isEmpty(), at ../jsgcinlines.h:324
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 684281
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: [sg:nse])
The following test asserts on mozilla-central revision e5815c156b6c (options -m -n -a):
function printStatus (msg) {}
try {
for ( var i = 0; i <= 0x017f; i++ ) {
for ( var i = 3; i >= 0; i-- ) {
if ( n >= Math.pow(16, i) ){}
}
}
} catch(exc1) {}
F = function () {};
F.prototype = new Int32Array(1);
o = new F();
function f1( __iterator__ ) {
for(var x in o)
printStatus(o[x]);
}
function assert(c) {}
assert(f1([]) == undefined);
Made this s-s because the assertion is GC related.
|
||
Updated•14 years ago
|
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
|
Reporter | |
Comment 2•14 years ago
|
||
Not a security problem according to duped bug.
Group: core-security
Whiteboard: js-triage-needed → [sg:nse]
|
|
Reporter | |
Comment 3•12 years ago
|
||
A testcase for this bug was already added in the original bug (bug 684281).
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•