649017 - TM: Crash due to call stack overflow [@ js_ValueToString]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on TI revision 74a8fb1bbec5 (works with most option combinations), tested on 64 bit:

throw {toString: parseInt.call};


This looks like a call stack overflow.

Comment 1

[Brian Hackett [Laid off!]]

TM tip is busted on this testcase too, not a TI bug.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   64672:0906d9490eaf
user:        Jeff Walden
date:        Mon Mar 28 20:01:53 2011 -0700
summary:     Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited.  r=luke

Comment 3

[Jeff Walden [:Waldo]]

Can't reproduce against latest TM tip, am I doing it wrong or did this go away?

Comment 4

[Jesse Ruderman]

Went away:

The first good revision is:
changeset:   43cef42964d7
user:        Tom Schuster (evilpies)
date:        Mon Apr 11 01:38:27 2011 -0700
summary:     Bug 601709 - Remove the misnomer InstanceOf variant methods by replacing their uses with clearer if-not-class-then-report code.  r=jwalden

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929