Closed Bug 639591 Opened 9 years ago Closed 9 years ago
TI+JM: GC-related crash
-- gczeal(2); var x; [eval("x")] ? eval("x") : 3; eval("Object()"); -- Crashes debug shell with -a -m -n, somewhere in GC code.
(gdb) p obj $1 = (JSObject *) 0x70fff0 (gdb) p obj->type $2 = (class js::types::TypeObject *) 0x0
eval scripts that are awaiting GC can also be entrained on the list of scripts in a compartment (had a forlorn :FIXME: wondering if this was possible, but no assertion). http://hg.mozilla.org/projects/jaegermonkey/rev/38c06cbd6993
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.