Closed Bug 969712 Opened 12 years ago Closed 12 years ago

[Security Review][Fuzzing][jsfunfuzz] Assertion failure: obj->inDictionaryMode() || parent->hasMissingSlot() || child.slot() == parent->maybeSlot() + 1, at vm/Shape.cpp

Categories

(mozilla.org :: Security Assurance: Review Request, task)

Product:
mozilla.org
Component:
Security Assurance: Review Request
Platform:
All
Linux
Type:
task
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: gkw, Assigned: gkw)

References

Details

(Whiteboard: [Fx])

JS fuzzing was requested for bug 961494. Goal is to find and fix potential regressions before landing.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.