Closed Bug 580699 Opened 13 years ago Closed 13 years ago

JM: Crash [@ js_TryMethod] or "Assertion failure: isObjectOrNull(),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

function f() {
    (function () {
        x;
        function a() {}
        print(a)
    })()
}
__defineGetter__("x", gc)
f()

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: isObjectOrNull(), at ../../jsvalue.h:536 and crashes js opt shell at js_TryMethod.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x080c6471 in js_TryMethod(JSContext*, JSObject*, JSAtom*, unsigned int, js::Value*, js::Value*) ()
#2  0x08277288 in ?? ()
#3  0x00000000 in ?? ()
(gdb) x/i $eip
=> 0x0:	Cannot access memory at address 0x0
Works for me on moo tip 64-bit and 32-bit.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Resolution: FIXED → WORKSFORME
Crash Signature: [@ js_TryMethod]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.