Closed Bug 580883 Opened 14 years ago Closed 14 years ago

JM: Crash [@ js::Interpret] or "Assertion failure: isObject(),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

[] = #1#
with(7) {
    var c
}

asserts js debug shell on JM changeset 7c6f62fcbd91 without -m or -j at Assertion failure: isObject(), at ../jsvalue.h:531
The testcase also crashes js opt shell without -m or -j at js::Interpret.

Program received signal SIGSEGV, Segmentation fault.
0x082036e6 in js::Interpret(JSContext*, JSStackFrame*, unsigned int) ()
(gdb) bt
#0  0x082036e6 in js::Interpret(JSContext*, JSStackFrame*, unsigned int) ()
#1  0x080ad724 in js::Execute(JSContext*, JSObject*, JSScript*, JSStackFrame*, unsigned int, js::Value*) ()
(gdb) x/i $eip
=> 0x82036e6 <_ZN2js9InterpretEP9JSContextP12JSStackFramej+13942>:	mov    (%edx),%eax
(gdb) x/b $edx
0xa2:	Cannot access memory at address 0xa2
Keywords: crash
Summary: JM: "Assertion failure: isObject()," → JM: Crash [@ js::Interpret] or "Assertion failure: isObject(),"
Crash Signature: [@ js::Interpret]
You need to log in before you can comment on or make changes to this bug.