Closed Bug 657585 Opened 14 years ago Closed 14 years ago

Crash [@ js_GetPropertyHelperInline] or [@ js_str_charAt] or [@ js_ValueToString]

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla6

People

(Reporter: gkw, Assigned: Waldo)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(2 files)

Attached file stacks
(e = []); (e.toString = "".charAt); (e::E); crashes js debug shell on TM changeset 0cf1acdb20b1 without any CLI parameters at js_GetPropertyHelperInline and crashes js opt shell at js_str_charAt. js_ValueToString is also on both stacks.
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 64602:0906d9490eaf user: Jeff Walden date: Mon Mar 28 20:01:53 2011 -0700 summary: Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited. r=luke
Blocks: 645468
Attached patch Patch and testSplinter Review
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #533008 - Flags: review?(luke)
Attachment #533008 - Flags: review?(luke) → review+
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla6
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Crash Signature: [@ js_GetPropertyHelperInline] [@ js_str_charAt] [@ js_ValueToString]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: