"Assertion failure: isObject()," with Worker

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [fuzzblocker:shell-worker] js-triage-needed)

(Reporter)

Description

5 years ago
'a'.replace(/a/,Worker.prototype.terminate)

asserts js debug shell on m-c changeset c61e7c3a232a without any CLI flags at Assertion failure: isObject(), with a tinderbox js shell downloaded off:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx-debug/1334696383/jsshell-mac.zip
(Reporter)

Comment 1

5 years ago
jsfunfuzz is now running on releng hardware, this assert is clouding results as creating an exception for this assert also ignores other non-Worker triggered testcases for this assert.
Whiteboard: js-triage-needed → [fuzzblocker] js-triage-needed

Comment 2

5 years ago
I turned off fuzzing of shell Worker, so now we're back where we were before.
Whiteboard: [fuzzblocker] js-triage-needed → [fuzzblocker:shell-worker] js-triage-needed
(Reporter)

Comment 3

5 years ago
(actually, FIXED by the removal of Worker, a known patch in bug 771281 - hurray!)
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.