Created attachment 547141 [details] stack Function("for(w in\\") crashes js debug shell on MI changeset without any CLI arguments at js::TokenStream::TokenBuf::getRawChar .
Got sleepy - should be MI changeset 47d8748daa90 !
I got the same crash signature with LangFuzz on mozilla-central revision c9cdc5df55f4.
Looks like a missing null-check of an expr() call -- probably from the recent rewrite of this code (did that land?).
Created attachment 547246 [details] [diff] [review] Patch and tests I'm not sure how many of these tests the patch actually fixes, but based on bug 672888, I'm guessing it's more than a few. Can't hurt to test more. :-)
Comment on attachment 547246 [details] [diff] [review] Patch and tests ★ Thank you.
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 73021:938c1a177114 user: Jason Orendorff date: Tue Jul 19 11:00:43 2011 -0500 summary: Bug 648175 - Remove JSOP_FOR*. Second second landing, to coin a phrase. r=dvander.
To anyone looking at the commit message for this push: yes, I know. Bug 506949, save me from myself!