https://home.eease.com/recruit/?id=496990 still asserts on Mac OS X 10.5. intel (at least) on tracemonkey Assertion failure: !p, at 2.0.0-tracemonkey/mozilla/js/src/jsiter.cpp:209 #0 0x0054c63f in JS_Assert (s=0x612a98 "!p", file=0x612904 "/work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsiter.cpp", ln=209) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsutil.cpp:81 #1 0x004a25f0 in Enumerate<KeyEnumeration> (cx=0x8394400, obj=0x207a3498, pobj=0x207a3498, id={asBits = 460411248}, enumerable=true, sharedPermanent=false, flags=1, ht=@0xbfffab98, props=@0xbfffacec) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsiter.cpp:209 #2 0x004a38ef in Snapshot<KeyEnumeration> (cx=0x8394400, obj=0x207a3498, flags=1, props=@0xbfffacec) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsiter.cpp:353 #3 0x004a6783 in GetIterator (cx=0x8394400, obj=0x207a3498, flags=1, vp=0xdde180) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsiter.cpp:663 #4 0x004a6a57 in js_ValueToIterator (cx=0x8394400, flags=1, vp=0xdde180) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsiter.cpp:779 #5 0x0047ad99 in js::Interpret (cx=0x8394400) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsinterp.cpp:2903 #6 0x0049d8f4 in js::InvokeCommon<int (*)(JSContext*, JSObject*, unsigned int, js::Value*, js::Value*)> (cx=0x8394400, fun=0x2072cc80, script=0x1c741c00, native=0, args=@0xbfffbf10, flags=0) at jsinterp.cpp:585 #7 0x004a047d in js::Invoke (cx=0x8394400, args=@0xbfffbf10, flags=0) at jsinterp.cpp:711 #8 0x004a09ca in js::InternalInvoke (cx=0x8394400, thisv=@0xbfffbf68, fval=@0xbfffbfa8, flags=0, argc=1, argv=0x86dee10, rval=0xbfffc070) at jsinterp.cpp:751 #9 0x003f3329 in js::InternalCall (cx=0x8394400, obj=0x1b7033b8, fval=@0xbfffbfa8, argc=1, argv=0x86dee10, rval=0xbfffc070) at jsinterp.h:322 #10 0x003f70d1 in JS_CallFunctionValue (cx=0x8394400, obj=0x1b7033b8, fval={asBits = 18446462629342495392, s = {payload = {i32 = 544883360, u32 = 544883360, boo = 544883360, str = 0x207a42a0, obj = 0x207a42a0, ptr = 0x207a42a0, why = 544883360}, tag = JSVAL_TAG_OBJECT}, asDouble = -nan(0xf0007207a42a0)}, argc=1, argv=0x86dee10, rval=0xbfffc070) at /work/mozilla/builds/2.0.0-tracemonkey/mozilla/js/src/jsapi.cpp:4760 ... on trunk Assertion failure: !p, at 2.0.0/mozilla/js/src/jsiter.cpp:176 #0 0x00504553 in JS_Assert (s=0x5c6cd4 "!p", file=0x5c68b0 "/work/mozilla/builds/2.0.0/mozilla/js/src/jsiter.cpp", ln=176) at /work/mozilla/builds/2.0.0/mozilla/js/src/jsutil.cpp:81 #1 0x004621de in Enumerate (cx=0x13c4400, obj=0x20a3ed80, pobj=0x20a3ed80, id=26850276, enumerable=true, sharedPermanent=false, flags=1, ht=@0xbfffb740, vec=@0xbfffb838) at /work/mozilla/builds/2.0.0/mozilla/js/src/jsiter.cpp:176 #2 0x00462b0c in Snapshot (cx=0x13c4400, obj=0x20a3ed80, flags=1, props=@0xbfffb838) at /work/mozilla/builds/2.0.0/mozilla/js/src/jsiter.cpp:347 #3 0x00462ea0 in GetIterator (cx=0x13c4400, obj=0x20a3ed80, flags=1, vp=0xd6e0d4) at /work/mozilla/builds/2.0.0/mozilla/js/src/jsiter.cpp:562 #4 0x004631b6 in js_ValueToIterator (cx=0x13c4400, flags=1, vp=0xd6e0d4) at /work/mozilla/builds/2.0.0/mozilla/js/src/jsiter.cpp:693 #5 0x0043a195 in js_Interpret (cx=0x13c4400) at jsops.cpp:460 #6 0x0045ba9c in Invoke<int (*)(JSContext*, JSObject*, unsigned int, long*, long*)> (cx=0x13c4400, fun=0x19c3578, script=0x2118bcb0, native=0, args=@0xbfffc100, flags=0) at jsinterp.cpp:602 #7 0x0045e346 in js_Invoke (cx=0x13c4400, args=@0xbfffc100, flags=0) at jsinterp.cpp:693 #8 0x0045e908 in js_InternalInvoke (cx=0x13c4400, thisv=547868896, fval=547611520, flags=0, argc=1, argv=0x1452210, rval=0xbfffc1ec) at jsinterp.cpp:739 #9 0x003baee5 in JS_CallFunctionValue (cx=0x13c4400, obj=0x20a7d0e0, fval=547611520, argc=1, argv=0x1452210, rval=0xbfffc1ec) at /work/mozilla/builds/2.0.0/mozilla/js/src/jsapi.cpp:4850 #10 0x048e5f13 in nsJSContext::CallEventHandler (this=0x209193c0, aTarget=0x1bc24e18, aScope=0x20a7d0e0, aHandler=0x20a3e380, aargv=0x21153de0, arv=0xbfffc34c) at /work/mozilla/builds/2.0.0/mozilla/dom/base/nsJSEnvironment.cpp:2224 ... Also crashes Minefield nightly with a bus error. No assertion on 1.9.1, 1.9.2

(In reply to comment #0) > Also crashes Minefield nightly with a bus error. http://crash-stats.mozilla.com/report/index/0ab51b7f-df62-45f1-89ca-d291f2100725

Bug 587268 has a testcase that triggers the same assertion.

Hmm, but that one doesn't trigger a crash in non-debug builds.

This does look to be the same as Bug 587268

Note other urls. http://www.tagged.com/browse.html#params=_F_20_-1_IN_0_Aligarh_Aligarh_undefined_-1_25_0_0_0_0_0_keyword__0_-1_-1_-1_1_3 https://home.eease.adp.com/recruit/?id=498132 https://home.eease.com/recruit/?id=284582 https://home.eease.com/recruit/?id=419146 https://home.eease.com/recruit/?id=456604 https://home.eease.com/recruit/?id=496990 If you need more, let me know.