Closed Bug 657585 Opened 10 years ago Closed 10 years ago

Crash [@ js_GetPropertyHelperInline] or [@ js_str_charAt] or [@ js_ValueToString]

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla6

People

(Reporter: gkw, Assigned: Waldo)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(2 files)

Attached file stacks
(e = []);
(e.toString = "".charAt);
(e::E);

crashes js debug shell on TM changeset 0cf1acdb20b1 without any CLI parameters at js_GetPropertyHelperInline and crashes js opt shell at js_str_charAt. js_ValueToString is also on both stacks.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   64602:0906d9490eaf
user:        Jeff Walden
date:        Mon Mar 28 20:01:53 2011 -0700
summary:     Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited.  r=luke
Blocks: 645468
Attached patch Patch and testSplinter Review
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #533008 - Flags: review?(luke)
Attachment #533008 - Flags: review?(luke) → review+
http://hg.mozilla.org/tracemonkey/rev/8af92dba2480
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla6
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Crash Signature: [@ js_GetPropertyHelperInline] [@ js_str_charAt] [@ js_ValueToString]
You need to log in before you can comment on or make changes to this bug.