Closed
Bug 352797
Opened 15 years ago
Closed 15 years ago
"Assertion failure: OBJ_GET_CLASS(cx, obj) == &js_BlockClass" with xml filtering predicate operator, eval.call, let
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9alpha1
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: crash, testcase, verified1.8.1.1)
Attachments
(1 file)
2.53 KB,
patch
|
mrbkap
:
review+
dveditz
:
approval1.8.1.1+
|
Details | Diff | Splinter Review |
js> (function() { let (x = eval.call(<x/>.(1), "")) {} })() Assertion failure: OBJ_GET_CLASS(cx, obj) == &js_BlockClass, at jsinterp.c:6024
Reporter | ||
Comment 1•15 years ago
|
||
Seems like a null deref in opt builds.
Reporter | ||
Comment 2•15 years ago
|
||
js> (function(){let x = 'fafafa'.replace(/a/g, new Script(''))})() Assertion failure: OBJ_GET_CLASS(cx, obj) == &js_BlockClass, at jsinterp.c:5835
Assignee | ||
Updated•15 years ago
|
Flags: blocking1.8.1.1?
OS: Mac OS X 10.4 → All
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.9alpha
Assignee | ||
Comment 3•15 years ago
|
||
We really should have seen this when hacking js_GetScopeChain. /be
Updated•15 years ago
|
Attachment #241748 -
Flags: review?(mrbkap) → review+
Assignee | ||
Comment 4•15 years ago
|
||
Fixed on trunk: Checking in jsfun.c; /cvsroot/mozilla/js/src/jsfun.c,v <-- jsfun.c new revision: 3.168; previous revision: 3.167 done Checking in jsinterp.c; /cvsroot/mozilla/js/src/jsinterp.c,v <-- jsinterp.c new revision: 3.298; previous revision: 3.297 done /be
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Assignee | ||
Updated•15 years ago
|
Attachment #241748 -
Flags: approval1.8.1.1?
Assignee | ||
Comment 5•15 years ago
|
||
The fix introduced bug 356250. /be
Assignee | ||
Updated•15 years ago
|
Comment 6•15 years ago
|
||
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-01.js,v done Checking in regress-352797-01.js; /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-01.js,v <-- regress-352797-01.js initial revision: 1.1 done RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-02.js,v done Checking in regress-352797-02.js; /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-02.js,v <-- regress-352797-02.js initial revision: 1.1 done
Flags: in-testsuite+
Updated•14 years ago
|
Flags: blocking1.8.1.1? → blocking1.8.1.1+
Comment 8•14 years ago
|
||
Comment on attachment 241748 [details] [diff] [review] fix approved for 1.8 branch, a=dveditz for drivers
Attachment #241748 -
Flags: approval1.8.1.1? → approval1.8.1.1+
Assignee | ||
Comment 9•14 years ago
|
||
Fixed on the 1.8 branch: Checking in jsfun.c; /cvsroot/mozilla/js/src/jsfun.c,v <-- jsfun.c new revision: 3.117.2.26; previous revision: 3.117.2.25 done Checking in jsinterp.c; /cvsroot/mozilla/js/src/jsinterp.c,v <-- jsinterp.c new revision: 3.181.2.72; previous revision: 3.181.2.71 done (along with the followup fix for bug 356250). /be
Keywords: fixed1.8.1.1
Comment 10•14 years ago
|
||
verified fixed 20061122 1.8.1.1 windows/linux/mac*, 1.9 windows/linux
Keywords: fixed1.8.1.1 → verified1.8.1.1
Comment 11•14 years ago
|
||
catch the indirect eval exception on trunk /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-02.js,v <-- regress-352797-02.js new revision: 1.3; previous revision: 1.2
You need to log in
before you can comment on or make changes to this bug.
Description
•