Closed Bug 639591 Opened 9 years ago Closed 9 years ago

TI+JM: GC-related crash

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

--
gczeal(2);
var x;
[eval("x")] ? eval("x") : 3;
eval("Object()");
--
Crashes debug shell with -a -m -n, somewhere in GC code.
Attached file Stack trace
(gdb) p obj
$1 = (JSObject *) 0x70fff0
(gdb) p obj->type
$2 = (class js::types::TypeObject *) 0x0
eval scripts that are awaiting GC can also be entrained on the list of scripts in a compartment (had a forlorn :FIXME: wondering if this was possible, but no assertion).

http://hg.mozilla.org/projects/jaegermonkey/rev/38c06cbd6993
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.