Closed
Bug 452298
Opened 16 years ago
Closed 16 years ago
"Assertion failure: slot < (uintN) (((jp->fun)->nargs + (jp->fun)->u.i.nvars) + (jp->fun)->u.i.nupvars)"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 451884
People
(Reporter: jruderman, Assigned: brendan)
Details
(Keywords: assertion)
Steps to reproduce:
0. Run a debug build of Firefox from mozilla-central.
1. Load http://blog.monkeykit.com/2007/10/19/installer-updated-to-v30b-for-iphone/.
2. Open a new window (Cmd+N)
3. Close the new window (Cmd+W)
4. Wait for a GC (2-10 seconds).
Result:
Assertion failure: slot < (uintN) (((jp->fun)->nargs + (jp->fun)->u.i.nvars) + (jp->fun)->u.i.nupvars), at /Users/jruderman/central/js/src/jsopcode.cpp:1184
Reporter | ||
Comment 1•16 years ago
|
||
The bug can also be triggered by loading this URL, which is loaded as an iframe from the URL above.
http://www.yelp.com/blogbadgemap?v=1&userid=UcARdl-68pTn5PNno7ngvQ&width=200&height=328&uicolor=ED5100&textcolor=FFFFFF&type=latest&speed=10
Reporter | ||
Comment 2•16 years ago
|
||
After reducing this a bit, I think it's a dup of bug 451884. It seems to involve eval, and js_DecompileValueGenerator is on the stack.
Depends on: 451884
Assignee | ||
Updated•16 years ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•