676760 - TI: Crash [@ JSString::isLinear()]

Status: RESOLVED DUPLICATE of bug 674843

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on TI revision e1508f49adc4 (run with -j -m -n -a), tested on 64 bit:


function reportCompare(expected, actual, description) {}
var AP = Array.prototype,
    rooter = {};
AP.__defineGetter__(0, function () new this);
function makeUpperCase(v, index, array) {
    try {} catch (e) {}
}
function ArrayCallback(state) {}
ArrayCallback.prototype.makeUpperCase = function (v, index, array) {};
function dumpError(e) e.stack;
var strings = ['hello', , ];
var sparsestrings = new Array;
sparsestrings[2] = 'sparse';
try {
    expect = obj = new ArrayCallback
    actual = strings.map(obj.makeUpperCase, obj).toString
} catch (e) {}
reportCompare(expect, actual, 'Array.map: lowercase with object callback');
try {
    sparsestrings.map(makeUpperCase).toString
} catch (e) {
    dumpError(e)
}

Comment 1

[Luke Wagner [:luke]]

Another manifestation of bug 674843.