Closed Bug 580885 Opened 12 years ago Closed 12 years ago

JM: Crash [@ js::ExecuteFrameGuard::~ExecuteFrameGuard] or "Assertion failure: origin != destination,"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

with(evalcx('')) {
    eval("for(z in[0]){}")
}

asserts js debug shell on JM changeset 7c6f62fcbd91 without -m or -j at Assertion failure: origin != destination, at ../jswrapper.cpp:509 and crashes js opt shell at js::ExecuteFrameGuard::~ExecuteFrameGuard

Program received signal SIGSEGV, Segmentation fault.
0x0806de6d in js::ExecuteFrameGuard::~ExecuteFrameGuard() ()
(gdb) bt
#0  0x0806de6d in js::ExecuteFrameGuard::~ExecuteFrameGuard() ()
#1  0x082786b0 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/i $eip
=> 0x806de6d <_ZN2js17ExecuteFrameGuardD1Ev+29>:	movl   $0x0,(%edx)
Works for me on moo tip 64-bit and 32-bit.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js::ExecuteFrameGuard::~ExecuteFrameGuard]
You need to log in before you can comment on or make changes to this bug.