User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:188.8.131.52) Gecko/2009060309 Ubuntu/9.04 (jaunty) Firefox/3.0.11 Build Identifier: The function nanojit::StackFilter::getTop (in jstracer.cpp) gets a SideExit * out of a GuardRecord and then casts it to a (VMSideExit *) and accesses fields only present in VMSideExit. It SideExit is not actually a VMSideExit (as is the case with the regexp compiler or my in-progress inline threading work), this can cause problems. If a SideExit falls near the end of a page, accessing the field could cause a crash. Reproducible: Always
The only reference to SideExit comes from a jit-test. Closing as nanojit is long gone.