Closed Bug 580699 Opened 12 years ago Closed 12 years ago

JM: Crash [@ js_TryMethod] or "Assertion failure: isObjectOrNull(),"

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

function f() {
    (function () {
        x;
        function a() {}
        print(a)
    })()
}
__defineGetter__("x", gc)
f()

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: isObjectOrNull(), at ../../jsvalue.h:536 and crashes js opt shell at js_TryMethod.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x080c6471 in js_TryMethod(JSContext*, JSObject*, JSAtom*, unsigned int, js::Value*, js::Value*) ()
#2  0x08277288 in ?? ()
#3  0x00000000 in ?? ()
(gdb) x/i $eip
=> 0x0:	Cannot access memory at address 0x0
Works for me on moo tip 64-bit and 32-bit.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Resolution: FIXED → WORKSFORME
Crash Signature: [@ js_TryMethod]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.