417883 - Crash [@ JS_InstanceOf] with e4x, __proto__

Status: RESOLVED DUPLICATE of bug 417893

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

This script makes debug js shell and debug Firefox crash [@ JS_InstanceOf].

var a = {};
a.__proto__ = <x/>;
var n = a.name;
(function() { var localN = n; localN(); })();


Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c

Thread 0 Crashed:
0   js 	0x00017728 JS_InstanceOf + 16 (jsapi.c:2767)
1   js 	0x000178e8 JS_GetInstancePrivate + 38 (jsapi.c:2811)
2   js 	0x000f0165 StartNonListXMLMethod + 148 (jsxml.c:5602)
3   js 	0x000f2442 xml_name + 37 (jsxml.c:6354)
4   js 	0x0007440c js_Interpret + 83825 (jsinterp.c:4654)
5   js 	0x0005e822 js_Execute + 794 (jsinterp.c:1653)
6   js 	0x0001c295 JS_ExecuteScript + 54 (jsapi.c:4805)
7   js 	0x00002339 Process + 883 (js.c:306)
8   js 	0x00002c2b ProcessArgs + 2005 (js.c:537)
9   js 	0x000086c3 main + 617 (js.c:3628)
10  js 	0x00001cc6 _start + 216
11  js 	0x00001bed start + 41

This crash appeared very recently.

Comment 1

[Brendan Eich [:brendan]]

Dup'ing forward to bug with patch.

/be

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 417893).