Closed Bug 452333 Opened 11 years ago Closed 11 years ago

TM: Crash [@ js_SkipWhiteSpace] with typeof(3) / 0

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: mrbkap)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

js -j
js> (function() { for (var j = 0; j < 5; ++j) { (typeof 3/0); } })()

Crash [@ js_SkipWhiteSpace] dereferencing the invalid address 0x20000007.

I'm curious why:
* This code has to be in a function in order to crash
* This code has to be executed *five* times to crash (rather than the usual three or four times)
Note: This appears to be unrelated to bug 452346.
Fixed in that changeset.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
By the way, this wasn't typeof infinity, it was |typeof(3) / 0|.
Summary: Crash [@ js_SkipWhiteSpace] with typeof infinity → Crash [@ js_SkipWhiteSpace] with typeof(3) / 0
Summary: Crash [@ js_SkipWhiteSpace] with typeof(3) / 0 → TM: Crash [@ js_SkipWhiteSpace] with typeof(3) / 0
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452333.js,v  <--  regress-452333.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/ad363cef0818
Flags: in-testsuite+
Flags: in-litmus-
Crash Signature: [@ js_SkipWhiteSpace]
You need to log in before you can comment on or make changes to this bug.