Closed Bug 555152 Opened 15 years ago Closed 15 years ago

JM: "Assertion failure: (uint32) index < arr->length, at ../jsscriptinlines.h"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase) 

(function() {
  for each(let x in [new Boolean(), new Boolean(), /x/, /x/]) {
    while (x % x * /x/) {}
  }
})()

asserts js debug shell on JM tip with -m and -j at Assertion failure: (uint32) index < arr->length, at ../jsscriptinlines.h:65
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug555152.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.