Closed Bug 956308 Opened 11 years ago Closed 10 years ago

Assertion failure: v.isUndefined(), at jsnum.cpp:1572

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
27 Branch
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 937089
Tracking Flags:
Tracking Status
firefox27 --- affected

People

(Reporter: decoder, Unassigned)

Details

(Keywords: assertion, testcase) 

The following testcase asserts on mozilla-beta revision db102e35eec3 (threadsafe build, run with --fuzzing-safe --ion-eager):


function test() {
eval('with ( arguments < 4 ) var arguments = [];');
} test();
I'm seeing this assertion on beta only and I wasn't sure if this assert has any security implications.
status-firefox27: --- → affected
Version: Trunk → 27 Branch
It looks like you added this in bug 892634, shu, can you take a look?  Thanks.
Flags: needinfo?(shu)
Group: javascript-core-security
Sorry for the late reply.

This was fixed by bug 937089. Not s-s; opening.
Group: core-security
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(shu)
Resolution: --- → DUPLICATE
Hm... I don't have the permission bits to uncheck javascript-core-security.
Group: javascript-core-security
You need to log in before you can comment on or make changes to this bug.