560153 - Crash [@js_NewRegExpObject] during test_hc_attrnormalize.html

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

Potentially the same bug as bug 545692/bug 543386?

Stack excerpt:
 0  libmozjs.dylib!js_NewRegExpObject [jsobj.h:3d137f5214ad : 184 + 0x0]
    eip = 0x002c893a   esp = 0xbfffa130   ebp = 0xbfffa1c8   ebx = 0x002c84a1
    esi = 0x05b1fe20   edi = 0x0f0d3200   eax = 0x05b1fe40   ecx = 0x00399160
    edx = 0x00000000   efl = 0x00210287
    Found by: given as instruction pointer in context
 1  libmozjs.dylib!js::Parser::primaryExpr(js::TokenKind, int) [jsparse.cpp:3d137f5214ad : 8359 + 0x1d]
    eip = 0x002b09f3   esp = 0xbfffa1d0   ebp = 0xbfffa2d8
    Found by: previous frame's frame pointer
 2  libmozjs.dylib!js::Parser::memberExpr(int) [jsparse.cpp:3d137f5214ad : 6920 + 0x16]
    eip = 0x002b3aa8   esp = 0xbfffa2e0   ebp = 0xbfffa358
    Found by: previous frame's frame pointer
 3  libmozjs.dylib!js::Parser::unaryExpr() [jsparse.cpp:3d137f5214ad : 6287 + 0xf]
    eip = 0x002b466e   esp = 0xbfffa360   ebp = 0xbfffa408
    Found by: previous frame's frame pointer
 4  libmozjs.dylib!js::Parser::mulExpr() [jsparse.cpp:3d137f5214ad : 6129 + 0x7]
    eip = 0x002b4d33   esp = 0xbfffa410   ebp = 0xbfffa448
    Found by: previous frame's frame pointer
 5  libmozjs.dylib!js::Parser::addExpr() [jsparse.cpp:3d137f5214ad : 6111 + 0x7]
    eip = 0x002b4ef3   esp = 0xbfffa450   ebp = 0xbfffa488
    Found by: previous frame's frame pointer

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Attachment: full stack

Comment 4

[Phil Ringnalda (:philor)]

(In reply to Gavin Sharp (use [e-mail] for email) from comment #0)
> Potentially the same bug as bug 545692/bug 543386?

Has the same resolution, anyway.