JM: Crash [@ js_PrimitiveToObject] or "Assertion failure: !JSVAL_IS_OBJECT(*vp), at ../jsobj.cpp"

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
9 years ago
6 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

9 years ago
(function() {
  for (a = 0; a < 2; a++)
    ''.watch("", function() {})
})()

crashes js opt shell with -m on JM tip at js_PrimitiveToObject and asserts js debug shell with -m on JM tip at Assertion failure: !JSVAL_IS_OBJECT(*vp), at ../jsobj.cpp:6294
(Reporter)

Comment 1

9 years ago
This is occurring significantly often on 64-bit Linux, and 32/64-bit Mac 10.6.3 js shells.
OS: Mac OS X → All
Hardware: x86 → All
Crash Signature: [@ js_PrimitiveToObject]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug557063.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.