Closed
Bug 557063
Opened 14 years ago
Closed 14 years ago
JM: Crash [@ js_PrimitiveToObject] or "Assertion failure: !JSVAL_IS_OBJECT(*vp), at ../jsobj.cpp"
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(4 keywords)
Crash Data
(function() { for (a = 0; a < 2; a++) ''.watch("", function() {}) })() crashes js opt shell with -m on JM tip at js_PrimitiveToObject and asserts js debug shell with -m on JM tip at Assertion failure: !JSVAL_IS_OBJECT(*vp), at ../jsobj.cpp:6294
Reporter | ||
Comment 1•14 years ago
|
||
This is occurring significantly often on 64-bit Linux, and 32/64-bit Mac 10.6.3 js shells.
OS: Mac OS X → All
Hardware: x86 → All
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/fd3d02608639
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Updated•13 years ago
|
Crash Signature: [@ js_PrimitiveToObject]
Comment 3•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug557063.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•