Closed
Bug 729910
Opened 12 years ago
Closed 12 years ago
Assertion failure: str, at ../../jsval.h:702 or Crash [@ JSString::isAtom] with OOM
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla13
People
(Reporter: decoder, Assigned: billm)
Details
(Keywords: assertion, crash, testcase, Whiteboard: js-triage-needed)
Crash Data
Attachments
(1 file)
842 bytes,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
The following test asserts on mozilla-central revision 9bde0d25d76e (options -m -n -a): var lfcode = new Array(); lfcode.push("function test()\ gc();\ gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 4*1024);\ function complexMult(a, b) {\ function complexAdd(a, b) {\ function abs(a) {\ function computeEscapeSpeed(c) {\ function createMandelSet(realRange, imagRange) {}\ }\ }\ }\ }\ "); lfcode.push("function testLambdaCtor( _ ) {\ for (var x = 0; x < 2; ++x) {\ var f = function(){};\ if (x == 1) gc();\ q = new f;\ }\ return q.__proto__ === (testLambdaCtor(\"9.2.1.7 XMLList [[DeepCopy]]\"));\ }\ assertEq(testLambdaCtor(), true);\ "); while (true) { var file = lfcode.shift(); if (file == undefined) { break; } if (file == "evaluate") { } else { evaluate(file); //loadFile(file); } } function loadFile(lfVarx) { try { if (lfVarx.substr(-3) == ".js") { } else { evaluate(lfVarx); } } catch (lfVare) { } } Originally, this asserted as: Assertion failure: !hasLazyType(), at ../jsobj.h:867 Crashes afterwards seem like safe null-pointer crashes (probably due to OOM).
Assignee | ||
Comment 1•12 years ago
|
||
Missing null check.
![]() |
||
Updated•12 years ago
|
Attachment #600065 -
Flags: review?(luke) → review+
Assignee | ||
Comment 2•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/f00bab9999f9
Target Milestone: --- → mozilla13
Comment 3•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/f00bab9999f9
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•