Created attachment 532927 [details] stacks (e = ); (e.toString = "".charAt); (e::E); crashes js debug shell on TM changeset 0cf1acdb20b1 without any CLI parameters at js_GetPropertyHelperInline and crashes js opt shell at js_str_charAt. js_ValueToString is also on both stacks.
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 64602:0906d9490eaf user: Jeff Walden date: Mon Mar 28 20:01:53 2011 -0700 summary: Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited. r=luke
Created attachment 533008 [details] [diff] [review] Patch and test
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #533008 - Flags: review?(luke)
OS: Mac OS X → All
Hardware: x86 → All
Target Milestone: --- → mozilla6
cdleary-bot mozilla-central merge info: http://hg.mozilla.org/mozilla-central/rev/8af92dba2480
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Crash Signature: [@ js_GetPropertyHelperInline] [@ js_str_charAt] [@ js_ValueToString]
You need to log in before you can comment on or make changes to this bug.