Closed
Bug 939015
Opened 11 years ago
Closed 11 years ago
"Assertion failure: !parent->inDictionary()" looping over huge string
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: jruderman, Assigned: shu)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
|
1.73 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
var s = 'A';
try {
while (true) {
s += s;
}
} catch(oom) { print(oom); }
for (var v in s) { }
Assertion failure: !parent->inDictionary(), at js/src/jspropertytree.cpp:59
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/4da4d90efca2
user: Shu-yu Guo
date: Tue Oct 08 15:14:04 2013 -0700
summary: Bug 903193 - Part 5: Refactor SetPropertyHelper and friends to have a thread local variant. (r=bhackett)
|
Assignee | |
Comment 2•11 years ago
|
||
How was the shell compiled? I get a different crash.
Flags: needinfo?(shu)
|
|
Assignee | |
Comment 3•11 years ago
|
||
Bug in the refactoring.
Assignee: nobody → shu
Attachment #8338915 -
Flags: review?(bhackett1024)
|
||
Updated•11 years ago
|
Attachment #8338915 -
Flags: review?(bhackett1024) → review+
|
|
Assignee | |
Comment 4•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/9710fcac8fc0
|
||
Comment 5•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/9710fcac8fc0
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in
before you can comment on or make changes to this bug.
Description
•