Closed Bug 914162 Opened 6 years ago Closed 6 years ago

Assertion failure: hasScript(), at ../jsfun.h:269

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla26

People

(Reporter: decoder, Assigned: till)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

The following testcase asserts on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe):


function test() {
function add(a, b) {}
  for (var i = 0; i < 10000; ++i) {}
  new add;
} test();
Assignee: general → till
Status: NEW → ASSIGNED
Attachment #801663 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/057cd362da69
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Either this bug or bug 909717 caused a 3% dromaeo-DOM regression on Mac....
Flags: needinfo?(till)
I'm pretty sure it's not this one. For the non-previously-crashing cases, it only adds a flag check.
Flags: needinfo?(till)
You need to log in before you can comment on or make changes to this bug.