Closed Bug 701768 Opened 13 years ago Closed 13 years ago

Assertion failure: length != 0, at frontend/TokenStream.cpp:97

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 699682

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: js-triage-needed) 

The following test asserts on mozilla-central revision (options ):

var o = {
      '',


Flagged this as S-s because this is a length related assertion and the code does a "while (--length != 0)". My knowledge of C evaluation order with unary operators isnt that fresh anymore but I guess this could overflow if length starts at 0 right? Unlock if this is harmless :)
"depends on" rather than "dupe" in case they turn out to be different.
Depends on: 699682
WFM in eb5d4c08a542, so I assume it's a dup.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Dup, and new/fixed fast enough to unhide.
Group: core-security
Resolution: WORKSFORME → DUPLICATE
A testcase for this bug was already added in the original bug (bug 699682).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.