Key Vulnerability Information Bug ID: 667507 Title: TM/JM: "Assertion failure: shape->previous() == obj->lastProperty()," with gc Status: Closed (VERIFIED FIXED) Product: Core Component: JavaScript Engine Platform: x86 macOS Type: defect Severity: critical Priority: Not set Milestone: mozilla8 Tracking Flags: - Firefox5: unaffected - Firefox6: unaffected - Firefox7: fixed - status1.9.2: --, unaffected Additional Information Reporter: gkw Assignee: igor Keywords: assertion, regression, testcase Whiteboard: [sg:critical?][needs aurora landing for Fx7][qa-] Main Discussion Points The vulnerability is related to GC and involves an assertion failure between shape->previous() and obj->lastProperty(). Identified via autoBisect pointing to changeset bf147b22f72c, associated with revision 71353:dc137da5a3b4. Discussed impact on Firefox 5/6/7; Firefox 7 was fixed. Patch #543785 submitted, reviewed, and tested successfully. Patch has been pushed to Mozilla Aurora branch.