Closed
Bug 416665
Opened 17 years ago
Closed 17 years ago
Crash when loading website with Firebug 1.1 installed [@ JS_Assert][@ js_GetIndexFromBytecode]
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9beta4
People
(Reporter: whimboo, Assigned: brendan)
References
()
Details
(Keywords: crash)
Crash Data
Attachments
(1 file, 2 obsolete files)
|
7.65 KB,
patch
|
igor
:
review+
brendan
:
approval1.9+
|
Details | Diff | Splinter Review |
Seen with the latest trunk build while loading the above website and Firebug 1.1 installed.
Backtrace:
#0 JS_Assert (s=0x110f784 "js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN", file=0x110f744 "/Users/henrik/Projects/mozilla/source/mozilla/js/src/jsopcode.c", ln=132) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsutil.c:63
#1 0x0109d14e in js_GetIndexFromBytecode (script=0x3afc9fb0, pc=0x3afc9fec "S", pcoff=0) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsopcode.c:132
#2 0x01061357 in js_FullTestPropertyCache (cx=0x3ab8ac50, pc=0x3afc9fec "S", objp=0xbfff978c, pobjp=0xbfff9788, entryp=0xbfff9634) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:267
#3 0x0107a7f0 in js_Interpret (cx=0x3ab8ac50, pc=0x3afc9fec "S", result=0xbfff9ad8) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:4602
#4 0x01063e73 in js_Execute (cx=0x3ab8ac50, chain=0x39817080, script=0x3afc9fb0, down=0xbfffd474, flags=24, result=0xbfff9c70) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1639
#5 0x01035dbd in JS_EvaluateUCInStackFrame (cx=0x3ab8ac50, fp=0xbfffd474, chars=0x3addf020, length=17, filename=0x3af8b830 "lib.createSourceFileForEval.getEvalBody", lineno=1, rval=0xbfff9c70) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsdbgapi.c:1224
#6 0x028106c0 in jsd_EvaluateUCScriptInStackFrame (jsdc=0x2937210, jsdthreadstate=0x3d3b0d40, jsdframe=0x3d3b0d60, bytes=0x3addf020, length=17, filename=0x3af8b830 "lib.createSourceFileForEval.getEvalBody", lineno=1, eatExceptions=0, rval=0xbfff9c70) at /Users/henrik/Projects/mozilla/source/mozilla/js/jsd/jsd_stak.c:457
#7 0x0280a9ac in JSD_AttemptUCScriptInStackFrame (jsdc=0x2937210, jsdthreadstate=0x3d3b0d40, jsdframe=0x3d3b0d60, bytes=0x3addf020, length=17, filename=0x3af8b830 "lib.createSourceFileForEval.getEvalBody", lineno=1, rval=0xbfff9c70) at /Users/henrik/Projects/mozilla/source/mozilla/js/jsd/jsdebug.c:793
#8 0x028170b9 in jsdStackFrame::Eval (this=0x3d3b0dc0, bytes=@0xbfffa1a0, fileName=0x3af8b830 "lib.createSourceFileForEval.getEvalBody", line=1, result=0xbfff9f14, _rval=0xbfff9f24) at /Users/henrik/Projects/mozilla/source/mozilla/js/jsd/jsd_xpc.cpp:1933
#9 0x01395b38 in NS_InvokeByIndex_P (that=0x3d3b0dc0, methodIndex=20, paramCount=5, params=0xbfff9ee4) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
#10 0x137067bf in XPCWrappedNative::CallMethod (ccx=@0xbfffa12c, mode=CALL_METHOD) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2339
#11 0x1370e2f8 in XPC_WN_CallMethod (cx=0x3ab8ac50, obj=0x39817580, argc=4, argv=0x2658e98, vp=0xbfffa260) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470
#12 0x010635a2 in js_Invoke (cx=0x3ab8ac50, argc=4, vp=0x2658e90, flags=0) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1400
#13 0x0107a035 in js_Interpret (cx=0x3ab8ac50, pc=0x397f696a ":", result=0xbfffaa68) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:4530
#14 0x0106362d in js_Invoke (cx=0x3ab8ac50, argc=1, vp=0x2658cf0, flags=2) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1416
#15 0x137013c5 in nsXPCWrappedJSClass::CallMethod (this=0x3d3af800, wrapper=0x3d3af950, methodIndex=3, info=0x22ee2b0, nativeParams=0xbfffaec4) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1473
#16 0x136f9b1f in nsXPCWrappedJS::CallMethod (this=0x3d3af950, methodIndex=3, info=0x22ee2b0, params=0xbfffaec4) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:556
#17 0x01395df2 in PrepareAndDispatch (self=0x3d3af990, methodIndex=3, args=0xbfffafe4) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#18 0x01395e50 in nsXPTCStubBase::Stub3 (this=0x3d3af990) at ../../../../../../dist/include/xpcom/xptcstubsdef.inc:5
#19 0x01395b38 in NS_InvokeByIndex_P (that=0x3d3af990, methodIndex=3, paramCount=2, params=0xbfffb214) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
#20 0x137067bf in XPCWrappedNative::CallMethod (ccx=@0xbfffb45c, mode=CALL_METHOD) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2339
#21 0x1370e2f8 in XPC_WN_CallMethod (cx=0x3ab8ac50, obj=0x349660a0, argc=1, argv=0x2658cdc, vp=0xbfffb590) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470
#22 0x010635a2 in js_Invoke (cx=0x3ab8ac50, argc=1, vp=0x2658cd4, flags=0) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1400
#23 0x0107a035 in js_Interpret (cx=0x3ab8ac50, pc=0x3993603b ":", result=0xbfffbd98) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:4530
#24 0x0106362d in js_Invoke (cx=0x3ab8ac50, argc=3, vp=0x2658b38, flags=2) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1416
#25 0x0105786a in fun_apply (cx=0x3ab8ac50, argc=3, vp=0x2658b20) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsfun.c:1626
#26 0x01079fce in js_Interpret (cx=0x3ab8ac50, pc=0x3993db67 ":", result=0xbfffc638) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:4512
#27 0x0106362d in js_Invoke (cx=0x3ab8ac50, argc=3, vp=0x2658af4, flags=2) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1416
#28 0x137013c5 in nsXPCWrappedJSClass::CallMethod (this=0x3b157f70, wrapper=0x3b1583b0, methodIndex=3, info=0x22eed00, nativeParams=0xbfffca94) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1473
#29 0x136f9b1f in nsXPCWrappedJS::CallMethod (this=0x3b1583b0, methodIndex=3, info=0x22eed00, params=0xbfffca94) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:556
#30 0x01395df2 in PrepareAndDispatch (self=0x3b1583f0, methodIndex=3, args=0xbfffcbb4) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#31 0x01395e50 in nsXPTCStubBase::Stub3 (this=0x3b1583f0) at ../../../../../../dist/include/xpcom/xptcstubsdef.inc:5
#32 0x0281bfe7 in jsds_ExecutionHookProc (jsdc=0x2937210, jsdthreadstate=0x3d3b0d40, type=1, callerdata=0x1, rval=0xbfffd134) at /Users/henrik/Projects/mozilla/source/mozilla/js/jsd/jsd_xpc.cpp:687
#33 0x0280cd53 in jsd_CallExecutionHook (jsdc=0x2937210, cx=0x3ab8ac50, type=1, hook=0x281bc16 <jsds_ExecutionHookProc(JSDContext*, JSDThreadState*, unsigned int, void*, long*)>, hookData=0x1, rval=0xbfffd134) at /Users/henrik/Projects/mozilla/source/mozilla/js/jsd/jsd_hook.c:177
#34 0x0280f3d2 in jsd_TrapHandler (cx=0x3ab8ac50, script=0x3d3b0800, pc=0x3d3b083c "9", rval=0xbfffd134, closure=0x3d3b0d01) at /Users/henrik/Projects/mozilla/source/mozilla/js/jsd/jsd_scpt.c:736
#35 0x01033d55 in JS_HandleTrap (cx=0x3ab8ac50, script=0x3d3b0800, pc=0x3d3b083c "9", rval=0xbfffd134) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsdbgapi.c:294
#36 0x0107d9f3 in js_Interpret (cx=0x3ab8ac50, pc=0x3d3b083c "9", result=0xbfffd498) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:5085
#37 0x01063e73 in js_Execute (cx=0x3ab8ac50, chain=0x39817080, script=0x3d3b0800, down=0x2658a28, flags=16, result=0xbfffd640) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1639
#38 0x01092c0a in obj_eval (cx=0x3ab8ac50, obj=0x33379940, argc=1, argv=0x2658ac4, rval=0xbfffd640) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsobj.c:1318
#39 0x010635a2 in js_Invoke (cx=0x3ab8ac50, argc=1, vp=0x2658abc, flags=0) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1400
#40 0x0107a035 in js_Interpret (cx=0x3ab8ac50, pc=0x3b1e3e2c "y", result=0xbfffde48) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:4530
#41 0x01063e73 in js_Execute (cx=0x3ab8ac50, chain=0x33379940, script=0x3d3ae590, down=0x0, flags=0, result=0xbfffdf78) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsinterp.c:1639
#42 0x0101f914 in JS_EvaluateUCScriptForPrincipals (cx=0x3ab8ac50, obj=0x33379940, principals=0x3afceb54, chars=0x3b1e0b80, length=8, filename=0x3af735f8 "http://www.wetteronline.de/startseite/includes/operationell/ticker_gif.js", lineno=103, rval=0xbfffdf78) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsapi.c:4891
#43 0x188a1188 in nsJSContext::EvaluateString (this=0x3ab8a2c0, aScript=@0xbfffe0e4, aScopeObject=0x33379940, aPrincipal=0x3afceb50, aURL=0x3af735f8 "http://www.wetteronline.de/startseite/includes/operationell/ticker_gif.js", aLineNo=103, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfffe0c8) at /Users/henrik/Projects/mozilla/source/mozilla/dom/src/base/nsJSEnvironment.cpp:1497
#44 0x188cf2b8 in nsGlobalWindow::RunTimeout (this=0x3b110520, aTimeout=0x3becbcc0) at /Users/henrik/Projects/mozilla/source/mozilla/dom/src/base/nsGlobalWindow.cpp:7556
#45 0x188cf966 in nsGlobalWindow::TimerCallback (aTimer=0x3beca990, aClosure=0x3becbcc0) at /Users/henrik/Projects/mozilla/source/mozilla/dom/src/base/nsGlobalWindow.cpp:7906
#46 0x01387d34 in nsTimerImpl::Fire (this=0x3beca990) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/threads/nsTimerImpl.cpp:400
#47 0x01387f61 in nsTimerEvent::Run (this=0x3d15ada0) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/threads/nsTimerImpl.cpp:488
#48 0x01383c7b in nsThread::ProcessNextEvent (this=0x29253d0, mayWait=0, result=0xbfffe324) at /Users/henrik/Projects/mozilla/source/mozilla/xpcom/threads/nsThread.cpp:510
#49 0x0132af3b in NS_ProcessPendingEvents_P (thread=0x29253d0, timeout=20) at nsThreadUtils.cpp:180
#50 0x15e8b6a1 in nsBaseAppShell::NativeEventCallback (this=0x2943f60) at /Users/henrik/Projects/mozilla/source/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:112
#51 0x15e6a501 in nsAppShell::ProcessGeckoEvents (aInfo=0x2943f60) at /Users/henrik/Projects/mozilla/source/mozilla/widget/src/cocoa/nsAppShell.mm:294
#52 0x9082cf1a in CFRunLoopRunSpecific ()
#53 0x9082ca56 in CFRunLoopRunInMode ()
#54 0x92df0878 in RunCurrentEventLoopInMode ()
#55 0x92defeb9 in ReceiveNextEventCommon ()
#56 0x92defdd9 in BlockUntilNextEventMatchingListInMode ()
#57 0x93296485 in _DPSNextEvent ()
#58 0x93296076 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#59 0x9328fdfb in -[NSApplication run] ()
#60 0x15e698b4 in nsAppShell::Run (this=0x2943f60) at /Users/henrik/Projects/mozilla/source/mozilla/widget/src/cocoa/nsAppShell.mm:565
#61 0x16d5bc5b in nsAppStartup::Run (this=0x2964700) at /Users/henrik/Projects/mozilla/source/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
#62 0x00211146 in XRE_main (argc=1, argv=0xbffff740, aAppData=0x290b2d0) at /Users/henrik/Projects/mozilla/source/mozilla/toolkit/xre/nsAppRunner.cpp:3145
#63 0x00002798 in main (argc=1, argv=0xbffff740) at /Users/henrik/Projects/mozilla/source/mozilla/browser/app/nsBrowserApp.cpp:158
Argument values:
(gdb) p *s
$1 = 106 'j'
(gdb) p *file
$2 = 47 '/'
Haven't tested it under Windows yet.
Flags: blocking1.9?
|
Reporter | |
Comment 1•17 years ago
|
||
This cannot happen under Windows when having a look at the source:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/js/src/jsutil.c&rev=3.296
eh? run it under a debugger, DebugBreak() will land you in the debugger. It's functionally equivalent.
|
|
Reporter | |
Comment 3•17 years ago
|
||
Oh right. But I forgot to say that no crash happens under Windows with the same versions of Minefield and Firebug.
|
Assignee | |
Updated•17 years ago
|
Assignee: general → brendan
Blocks: js-propcache
Flags: blocking1.9? → blocking1.9+
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9beta4
|
|
Assignee | |
Comment 4•17 years ago
|
||
Henrik: could you please reproduce in a debugger and print op and js_CodeSpec[op]? Thanks,
/be
|
|
Reporter | |
Comment 5•17 years ago
|
||
Sure. Here the output of the debugger:
(gdb) frame 1
#1 0x0109d14e in js_GetIndexFromBytecode (script=0x40034ca0, pc=0x40034cdc "S", pcoff=0) at /Users/henrik/Projects/mozilla/source/mozilla/js/src/jsopcode.c:132
132 JS_ASSERT(js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN);
Current language: auto; currently c
(gdb) p op
$1 = JSOP_TRAP
(gdb) p js_CodeSpec[op]
$2 = {
length = 1 '\001',
nuses = 0 '\0',
ndefs = 0 '\0',
prec = 0 '\0',
format = 0
}
|
|
Assignee | |
Updated•17 years ago
|
Status: NEW → ASSIGNED
|
|
Assignee | |
Comment 6•17 years ago
|
||
Henrik, can you test this? Thanks,
/be
Attachment #303216 -
Flags: review?(igor)
|
||
Comment 7•17 years ago
|
||
Comment on attachment 303216 [details] [diff] [review]
proposed fix
>Index: jsopcode.c
>===================================================================
>RCS file: /cvsroot/mozilla/js/src/jsopcode.c,v
>retrieving revision 3.290
>diff -p -u -8 -r3.290 jsopcode.c
>--- jsopcode.c 10 Feb 2008 03:30:08 -0000 3.290
>+++ jsopcode.c 14 Feb 2008 07:12:57 -0000
>@@ -124,16 +124,21 @@ GetJumpOffset(jsbytecode *pc, jsbytecode
>
> uintN
> js_GetIndexFromBytecode(JSScript *script, jsbytecode *pc, ptrdiff_t pcoff)
> {
> JSOp op;
> uintN span, base;
>
> op = (JSOp)*pc;
>+ if (op == JSOP_TRAP) {
>+ op = JS_GetTrapOpcode(cx, script, pc);
This would not compile as js_GetIndexFromBytecode does not take cx.
>+ if (op == JSOP_LIMIT)
>+ return 0;
>+ }
The callers of js_GetIndexFromBytecode expect that the function never fails. I think passing the bytecode itself to the function would fix the issue in a proper way.
Attachment #303216 -
Flags: review?(igor) → review-
|
|
Assignee | |
Comment 8•17 years ago
|
||
Failure is not possible with a properly threaded debugger embedding, that pattern of checking for JSOP_LIMIT is just paranoia -- see JS_GetTrapOpcode:
JS_PUBLIC_API(JSOp)
JS_GetTrapOpcode(JSContext *cx, JSScript *script, jsbytecode *pc)
{
JSTrap *trap;
DBG_LOCK_EVAL(cx->runtime, trap = FindTrap(cx->runtime, script, pc));
if (!trap) {
#ifdef JS_THREADSAFE
/*
* If we lost a race with another thread, return JSOP_LIMIT so our
* caller can detect this case and do something sane.
*/
#else
JS_ASSERT(0); /* XXX can't happen */
#endif
return JSOP_LIMIT;
}
return trap->op;
}
I would prefer to reparameterize js_GetIndexFromBytecode but keep it infallible. Igor, how does that sound?
/be
|
|
||
Comment 9•17 years ago
|
||
(In reply to comment #8)
> Failure is not possible with a properly threaded debugger embedding, that
> pattern of checking for JSOP_LIMIT is just paranoia -- see JS_GetTrapOpcode:
>
> JS_PUBLIC_API(JSOp)
> JS_GetTrapOpcode(JSContext *cx, JSScript *script, jsbytecode *pc)
> {
> JSTrap *trap;
>
> DBG_LOCK_EVAL(cx->runtime, trap = FindTrap(cx->runtime, script, pc));
> if (!trap) {
> #ifdef JS_THREADSAFE
> /*
> * If we lost a race with another thread, return JSOP_LIMIT so our
> * caller can detect this case and do something sane.
> */
How that can be a paranoia if the code explicitly allows to fail?
|
|
||
Comment 10•17 years ago
|
||
(In reply to comment #8)
> JS_PUBLIC_API(JSOp)
> JS_GetTrapOpcode(JSContext *cx, JSScript *script, jsbytecode *pc)
> {
> JSTrap *trap;
>
> DBG_LOCK_EVAL(cx->runtime, trap = FindTrap(cx->runtime, script, pc));
> if (!trap) {
> #ifdef JS_THREADSAFE
> /*
> * If we lost a race with another thread, return JSOP_LIMIT so our
> * caller can detect this case and do something sane.
> */
I guess this is a bug in JS_GetTrapOpcode. It should never fail. Instead it can just check under the lock the value of *pc. If it is not [trap], then it should just return it.
|
|
Assignee | |
Comment 11•17 years ago
|
||
Right! For the longest time, the jsdbgapi.c code lacked any thread safety. You had to run one debugger in one thread, and not have racing trap-opcode setters or anything like that. But now that we lock, it's easy to fix. I will do this later today (feel free to steal this bug, though!).
/be
|
|
Assignee | |
Comment 12•17 years ago
|
||
Attachment #303216 -
Attachment is obsolete: true
|
|
Assignee | |
Updated•17 years ago
|
Attachment #303653 -
Flags: review?(igor)
|
|
||
Comment 13•17 years ago
|
||
Comment on attachment 303653 [details] [diff] [review]
better proposed fix
>diff -p -u -8 -r3.291 jsopcode.c
>--- jsopcode.c 16 Feb 2008 02:46:46 -0000 3.291
>+++ jsopcode.c 16 Feb 2008 03:12:53 -0000
>@@ -3804,27 +3805,27 @@ Decompile(SprintStack *ss, jsbytecode *p
> op = ((js_CodeSpec[op].format & JOF_PARENHEAD) ||
> ((js_CodeSpec[op].format & JOF_INVOKE) &&
> GET_ARGC(pc + len) == 1) ||
> (((op == JSOP_IFEQ || op == JSOP_IFEQX) &&
> (sn2 = js_GetSrcNote(outer, pc + len)) &&
> SN_TYPE(sn2) != SRC_COND)))
> ? JSOP_POP
> : JSOP_SETNAME;
>+ }
>
> /*
> * Stack this result as if it's a name, not an anonymous
> * function, so it doesn't get decompiled as a generator
> * function in a getter or setter context. The precedence
> * level is the same for JSOP_NAME and JSOP_ANONFUNOBJ.
> */
> LOCAL_ASSERT(js_CodeSpec[JSOP_NAME].prec ==
> js_CodeSpec[saveop].prec);
> saveop = JSOP_NAME;
>- }
This fixes a bug an unrelated bug, doesn't it? I.e without the patch saveop would not be stacked, right?
r+ with this mystery resolved.
|
|
Assignee | |
Comment 14•17 years ago
|
||
Yes, I noticed the indentation wrongness and reasoned that the brace was misplaced -- want me to split it out into another bug? Could use your confirmation of my reasoning in any event.
/be
|
|
||
Comment 15•17 years ago
|
||
(In reply to comment #14)
> Yes, I noticed the indentation wrongness and reasoned that the brace was
> misplaced -- want me to split it out into another bug?
That would be ideal. I wish bugzilla would have an option like clone bug to quickly file stuff like that...
|
||
Comment 16•17 years ago
|
||
Look for "Clone This Bug" near the bottom of the page... On the same line with the bold "BUG LIST:"
|
|
Assignee | |
Comment 17•17 years ago
|
||
Attachment #303653 -
Attachment is obsolete: true
Attachment #303840 -
Flags: review?(igor)
Attachment #303653 -
Flags: review?(igor)
|
|
||
Updated•17 years ago
|
Attachment #303840 -
Flags: review?(igor) → review+
|
|
Assignee | |
Updated•17 years ago
|
Attachment #303840 -
Flags: approval1.9+
|
|
Assignee | |
Comment 18•17 years ago
|
||
Fixed:
js/src/jsdbgapi.c 3.129
js/src/jsopcode.c 3.293
js/src/jsopcode.h 3.59
/be
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
|
Reporter | |
Comment 19•17 years ago
|
||
Verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b4pre) Gecko/2008021804 Minefield/3.0b4pre ID:2008021804
Status: RESOLVED → VERIFIED
|
||
Updated•17 years ago
|
Flags: in-testsuite-
Flags: in-litmus-
|
||
Updated•14 years ago
|
Crash Signature: [@ JS_Assert]
[@ js_GetIndexFromBytecode]
You need to log in
before you can comment on or make changes to this bug.
Description
•