301787 - crash [@ JS_InstanceOf] (destroyed atom)

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect, P5)

Description

[timeless]

trunk build from yesterday w/ lots of changes (it's my tree...)

more complete details are in the url, i'll copy them into this bug next week

 	js3250.dll!JS_InstanceOf(JSContext * cx=0x00b8c028, JSObject * obj=0xddddddd8,
JSClass * clasp=0x00d59c10, long * argv=0x00000000)  Line 2120 + 0x3	C
 	js3250.dll!js_regexp_toString(JSContext * cx=0x00b8c028, JSObject *
obj=0xddddddd8, unsigned int argc=0x00000000, long * argv=0x00000000, long *
rval=0x00127f18)  Line 3460 + 0x16	C
>	js3250.dll!Decompile(SprintStack * ss=0x00127fa8, unsigned char *
pc=0x046eec68, int nb=0x00000006)  Line 2062 + 0x1b	C
 	js3250.dll!js_DecompileCode(JSPrinter * jp=0x045719e8, JSScript *
script=0x046eec38, unsigned char * pc=0x046eec68, unsigned int len=0x00000006) 
Line 2655 + 0x11	C
 	js3250.dll!js_DecompileValueGenerator(JSContext * cx=0x00b8c028, int
spindex=0xfffffffa, long v=0x80000001, JSString * fallback=0x00ac9808)  Line
3001 + 0x15	C
 	js3250.dll!js_ReportIsNotFunction(JSContext * cx=0x00b8c028, long *
vp=0x018cc034, unsigned int flags=0x00000000)  Line 2104 + 0x52	C
 	js3250.dll!js_Invoke(JSContext * cx=0x00b8c028, unsigned int argc=0x00000001,
unsigned int flags=0x00000000)  Line 1238 + 0x14	C
 	js3250.dll!js_Interpret(JSContext * cx=0x00b8c028, unsigned char *
pc=0x046eec75, long * result=0x00128b40)  Line 3466 + 0xf	C
 	js3250.dll!js_Execute(JSContext * cx=0x00b8c028, JSObject * chain=0x04548798,
JSScript * script=0x046eec38, JSStackFrame * down=0x00000000, unsigned int
flags=0x00000000, long * result=0x00128c4c)  Line 1403 + 0x13	C
 	js3250.dll!JS_EvaluateUCScriptForPrincipals(JSContext * cx=0x00b8c028,
JSObject * obj=0x04548798, JSPrincipals * principals=0x00b3a98c, const unsigned
short * chars=0x044e84c0, unsigned int length=0x0000002f, const char *
filename=0x00128cf0, unsigned int lineno=0x0000004d, long * rval=0x00128c4c) 
Line 3885 + 0x19	C
 	gklayout.dll!nsJSContext::EvaluateStringWithValue(const nsAString_internal &
aScript={...}, void * aScopeObject=0x04548798, nsIPrincipal *
aPrincipal=0x00000000, const char * aURL=0x00128cf0, unsigned int
aLineNo=0x0000004d, const char * aVersion=0x00000000, void *
aRetValue=0x00128ccc, int * aIsUndefined=0x00128d34)  Line 866 + 0x43	C++
 	gklayout.dll!nsXBLProtoImplField::InstallMember(nsIScriptContext *
aContext=0x00b8af48, nsIContent * aBoundElement=0x0431a340, void *
aScriptObject=0x04548798, void * aTargetClassObject=0x00000000, const nsCString
& aClassStr={...})  Line 126 + 0x62	C++