Closed Bug 557063 Opened 12 years ago Closed 12 years ago

JM: Crash [@ js_PrimitiveToObject] or "Assertion failure: !JSVAL_IS_OBJECT(*vp), at ../jsobj.cpp"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

(function() {
  for (a = 0; a < 2; a++)
    ''.watch("", function() {})
})()

crashes js opt shell with -m on JM tip at js_PrimitiveToObject and asserts js debug shell with -m on JM tip at Assertion failure: !JSVAL_IS_OBJECT(*vp), at ../jsobj.cpp:6294
This is occurring significantly often on 64-bit Linux, and 32/64-bit Mac 10.6.3 js shells.
OS: Mac OS X → All
Hardware: x86 → All
Crash Signature: [@ js_PrimitiveToObject]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug557063.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.