The default bug view has changed. See this FAQ.

Crash [@ js_FindXMLProperty] or "Assertion failure: nameval.isObject(),"

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: Waldo)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla11
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-done, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 573360 [details]
stack

var w, V
(function::V)

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: nameval.isObject(), and crashes js opt shell at js_FindXMLProperty

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   80013:944c81533751
user:        Jeff Walden
date:        Tue Oct 25 16:04:48 2011 -0700
summary:     Bug 697297 - Replace TOK_UNARYOP with separate kinds for each op it covers, in both the tokenizer and in the parser (with different semantics in each!).  r=dherman, r=cdleary
(Reporter)

Updated

6 years ago
Crash Signature: [@ js_FindXMLProperty]
Duplicate of this bug: 701247
This should be fixed by the push for bug 701222, which is winding its way through m-i right now.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: js-triage-needed → js-triage-done
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/46b40e2c1953
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.