196306 2019-03-27 11:11:58 -0700 [WebKit/JavaScriptCore] Assertion failed at Source/JavaScriptCore/runtime/JSArray.h:276 2019-03-28 11:08:45 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED INVALID P2 Normal --- 1 sevendays37 webkit-unassigned ap fpizlo oldest_to_newest 1521751 0 sevendays37 2019-03-27 11:11:58 -0700 The debug build of JavaScriptCore failed assertion at Source/JavaScriptCore/runtime/JSArray.h:276. PoC: var var_0 = []; for (var var_1 = 0; var_1 < 100000; ++var_1) var_0.push(new Array(var_1)); Commit: 6369975 OS: Ubuntu 18.04.1 LTS Arch: x86_64 1522117 1 ap 2019-03-28 11:08:45 -0700 This test hits out of memory, so the process is intentionally terminated.