Closed
Bug 858066
Opened 12 years ago
Closed 12 years ago
Assertion failure: v.isBoolean(), at jsobj.cpp:4628
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 855083
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
The following testcase asserts on mozilla-central revision c232bec6974d (no options required):
test();
function test() {
with (arguments)
var arguments = "";
}
|
Reporter | |
Comment 1•12 years ago
|
||
Marked s-s because I don't know if this assert indicates a possible security problem (e.g. type confusion). Please unhide if this is harmless :)
Whiteboard: [jsbugmon:update,bisect]
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
|
|
Reporter | |
Comment 2•12 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 122445:e3b899354a6f
user: Brian Hackett
date: Wed Feb 20 04:54:13 2013 -0700
summary: Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.
This iteration took 1.430 seconds to run.
|
|
Reporter | |
Updated•12 years ago
|
Group: core-security
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
|
|
Reporter | |
Updated•12 years ago
|
Flags: needinfo?(bhackett1024)
You need to log in
before you can comment on or make changes to this bug.
Description
•