342768 - js1_5/Regress/regress-317476.js: result: CRASHED type: browser

Status: RESOLVED DUPLICATE of bug 342448

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

found on trunk. all platforms crash. this stack is from winxp.

+		str	0x00000000 {length=??? chars=??? }	JSString *

js_GetStringChars(JSString *str)
{
=>    if (JSSTRING_IS_DEPENDENT(str) && !js_UndependString(NULL, str))
        return NULL;

    *js_GetGCThingFlags(str) &= ~GCF_MUTABLE;
    return str->chars;
}



>	js3250.dll!js_GetStringChars(JSString * str=0x00000000)  Line 121 + 0x3 bytes	C
 	js3250.dll!JS_GetStringChars(JSString * str=0x00000000)  Line 4543 + 0x9 bytes	C
 	gklayout.dll!nsJSScriptTimeoutHandler::GetHandlerText()  Line 318 + 0xd bytes	C++
 	gklayout.dll!nsGlobalWindow::RunTimeout(nsTimeout * aTimeout=0x040cd690)  Line 6458 + 0x21 bytes	C++
 	gklayout.dll!nsGlobalWindow::TimerCallback(nsITimer * aTimer=0x040cd6f8, void * aClosure=0x040cd690)  Line 6806	C++
 	xpcom_core.dll!nsTimerImpl::Fire()  Line 400 + 0x13 bytes	C++
 	xpcom_core.dll!nsTimerEvent::Run()  Line 486	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=0x00000001, int * result=0x0012fc34)  Line 483	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00b08320, int mayWait=0x00000001)  Line 225 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 153 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 171 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=0x00000003, char * * argv=0x00b07fe0, const nsXREAppData * aAppData=0x004036b0)  Line 2349 + 0x25 bytes	C++
 	firefox.exe!main(int argc=0x00000003, char * * argv=0x00b07fe0)  Line 61 + 0x13 bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes	C
 	firefox.exe!mainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

*** This bug has been marked as a duplicate of 342448 ***