Closed
Bug 566781
Opened 14 years ago
Closed 14 years ago
"Assertion failure: JSVAL_IS_OBJECT(v)" with empty harmony:proxy, GC
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: gal)
References
Details
(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
(deleted),
patch
|
shaver
:
review+
|
Details | Diff | Splinter Review |
var w = Proxy.createFunction({}, function(){});
gc();
Assertion failure: JSVAL_IS_OBJECT(v), at ../jsapi.h:183
|
Assignee | |
Comment 1•14 years ago
|
||
Assignee: general → gal
Comment on attachment 446131 [details] [diff] [review] patch r=shaver
Attachment #446131 -
Flags: review+
|
|
Assignee | |
Comment 3•14 years ago
|
||
Regressor patch was in the tree only for a few minutes without a fix. Not exploitable. http://hg.mozilla.org/tracemonkey/rev/0d87cf478f15
Group: core-security
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
|
||
Comment 4•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/0d87cf478f15
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•