566071 - Crash [@js_NewRegExpObject] during test_characterdataindexsizeerrdeletedataoffsetgreater.html

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Phil Ringnalda (:philor)]

Attachment: full crashdump

+++ This bug was initially created as a clone of Bug #560153 +++

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1273876018.1273877406.31460.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central opt test mochitests-2/5 on 2010/05/14 15:26:58
s: talos-r3-leopard-026

6006 INFO Running /tests/dom/tests/mochitest/dom-level1-core/test_characterdataindexsizeerrdeletedataoffsetgreater.html...
TEST-UNEXPECTED-FAIL | automation.py | Exited with code 1 during test run

Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash address: 0x0

Thread 0 (crashed)
 0  libmozjs.dylib!js_NewRegExpObject [jsobj.h:f7560e802592 : 184 + 0x0]
    eip = 0x002ca18a   esp = 0xbfffa020   ebp = 0xbfffa0b8   ebx = 0x002c9cf1
    esi = 0x2279dfc0   edi = 0x04f93400   eax = 0x2279dfe0   ecx = 0x0039b0e0
    edx = 0x00000000   efl = 0x00210283
    Found by: given as instruction pointer in context
 1  libmozjs.dylib!js::Parser::primaryExpr(js::TokenKind, int) [jsparse.cpp:f7560e802592 : 8390 + 0x1d]
    eip = 0x002b18a3   esp = 0xbfffa0c0   ebp = 0xbfffa1c8
    Found by: previous frame's frame pointer
 2  libmozjs.dylib!js::Parser::memberExpr(int) [jsparse.cpp:f7560e802592 : 6951 + 0x16]
    eip = 0x002b4958   esp = 0xbfffa1d0   ebp = 0xbfffa248
    Found by: previous frame's frame pointer
 3  libmozjs.dylib!js::Parser::unaryExpr() [jsparse.cpp:f7560e802592 : 6318 + 0xf]
    eip = 0x002b551e   esp = 0xbfffa250   ebp = 0xbfffa2f8
    Found by: previous frame's frame pointer
 4  libmozjs.dylib!js::Parser::mulExpr() [jsparse.cpp:f7560e802592 : 6157 + 0x7]
    eip = 0x002b5c03   esp = 0xbfffa300   ebp = 0xbfffa338
    Found by: previous frame's frame pointer
 5  libmozjs.dylib!js::Parser::addExpr() [jsparse.cpp:f7560e802592 : 6139 + 0x7]
    eip = 0x002b5dc3   esp = 0xbfffa340   ebp = 0xbfffa378
    Found by: previous frame's frame pointer
 6  libmozjs.dylib!js::Parser::relExpr() [jsparse.cpp:f7560e802592 : 6124 + 0x7]
    eip = 0x002b5fa8   esp = 0xbfffa380   ebp = 0xbfffa3d8
    Found by: previous frame's frame pointer