Closed Bug 761396 Opened 9 years ago Closed 9 years ago

"Assertion failure: offset < script->length,"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 759719
Tracking Status
firefox12 --- unaffected
firefox13 --- unaffected
firefox14 --- unaffected
firefox15 --- fixed

People

(Reporter: gkw, Unassigned)

References

Details

(5 keywords, Whiteboard: [sg:dupe 759719])

Attachments

(4 files)

Attached file stack
The upcoming attached testcase asserts 64-bit (tested on Windows 7, but assert also seems to show up in Mac OS X 10.7) js debug shell on m-c changeset 0e4f8e1a141b with -m and -n at Assertion failure: offset < script->length,

I'd be cautious about this TI bug and mark it s-s pending further analysis.

The first bad revision is:
changeset:   94968:de141e924806
user:        Brian Hackett
date:        Fri May 25 08:20:33 2012 -0700
summary:     Move JIT handles in scripts to a separate structure, bug 758613. r=
dvander
Attached file fragile testcase
s/TI bug/JIT bug
Put this testcase in a subfolder and pass it into the shell with -m and -n:

./js -m -n subfolder/testcase.js

Valgrind errors should show up.
Attached file stack
Valgrind stack for previous testcase.

This testcase seems like a similar bug because autoBisect points to the same regressing changeset in comment 0.
Very likely a dup of bug 759719 based on the Valgrind stack.
Seems to be a dupe. I just checked that the patch in that bug fixes the issues in this bug.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 759719
Large fragile testcase, resolved DUPE -> in-testsuite-
Flags: in-testsuite-
Group: core-security
Keywords: sec-criticalsec-other
Whiteboard: js-triage-needed → [sg:dupe 759719]
You need to log in before you can comment on or make changes to this bug.