Closed Bug 756582 Opened 12 years ago Closed 11 years ago

JS OOM Testing: Assertion failure: strcmp(lval + strlen(lval) - 9, " = <next>") == 0, at js/src/jsopcode.cpp:3831

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, sec-moderate, testcase, Whiteboard: [js:inv:p1]) 

The following command asserts on mozilla-central revision f4d51fab6cec (dbg build):

js  -e 'const libdir = "/home/decoder/Mozilla/JSBugMon/repos/ionmonkey/js/src/jit-test/lib/";' -A 8198 -f /home/decoder/Mozilla/JSBugMon/repos/ionmonkey/js/src/jit-test/tests/for-of/decompiler.js
Script had the wrong basepath in it, that's why it did not strip absolute paths, but the command should be clear anyway I guess :)

Marked this s-s because previous bug with this assertion has been sg:critical.
Whiteboard: [js:inv:p1]
sec-moderate due to OOM condition required.
Keywords: sec-moderate
Very likely fixed by the decompiler removal, marking as WFM.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.