[jsdbg2] Crash [@ JSObject::getClass] when cloning null

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {crash, testcase})

Other Branch
x86_64
Linux
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following code crashes on jsdbg2 branch (revision f189dd6316eb, options -j -m -a -d):

var g2 = newGlobal('new-compartment');
g2.clone(null);


Looks like a simple null-pointer deref, probably a minor problem.
(Assignee)

Comment 1

6 years ago
Created attachment 551852 [details] [diff] [review]
v1
Assignee: general → jorendorff
Attachment #551852 - Flags: review?(jimb)

Updated

6 years ago
Attachment #551852 - Flags: review?(jimb) → review+
(Assignee)

Comment 2

6 years ago
http://hg.mozilla.org/users/jblandy_mozilla.com/jsdbg2/rev/7333f4075063
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 3

4 years ago
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/extensions/regress-677589.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.