Created attachment 532927 [details] stacks (e = ); (e.toString = "".charAt); (e::E); crashes js debug shell on TM changeset 0cf1acdb20b1 without any CLI parameters at js_GetPropertyHelperInline and crashes js opt shell at js_str_charAt. js_ValueToString is also on both stacks.
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 64602:0906d9490eaf user: Jeff Walden date: Mon Mar 28 20:01:53 2011 -0700 summary: Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited. r=luke
Created attachment 533008 [details] [diff] [review] Patch and test
cdleary-bot mozilla-central merge info: http://hg.mozilla.org/mozilla-central/rev/8af92dba2480