580699 - JM: Crash [@ js_TryMethod] or "Assertion failure: isObjectOrNull(),"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {
    (function () {
        x;
        function a() {}
        print(a)
    })()
}
__defineGetter__("x", gc)
f()

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: isObjectOrNull(), at ../../jsvalue.h:536 and crashes js opt shell at js_TryMethod.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x080c6471 in js_TryMethod(JSContext*, JSObject*, JSAtom*, unsigned int, js::Value*, js::Value*) ()
#2  0x08277288 in ?? ()
#3  0x00000000 in ?? ()
(gdb) x/i $eip
=> 0x0:	Cannot access memory at address 0x0

Comment 1

[Andrew Drake [:adrake]]

Works for me on moo tip 64-bit and 32-bit.

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929