Closed Bug 701224 Opened 8 years ago Closed 8 years ago

Crash [@ js_FindXMLProperty] or "Assertion failure: nameval.isObject(),"

Categories

(Core :: JavaScript Engine, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla11

People

(Reporter: gkw, Assigned: Waldo)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: js-triage-done)

Crash Data

Attachments

(1 file)

Attached file stack
var w, V
(function::V)

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: nameval.isObject(), and crashes js opt shell at js_FindXMLProperty

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   80013:944c81533751
user:        Jeff Walden
date:        Tue Oct 25 16:04:48 2011 -0700
summary:     Bug 697297 - Replace TOK_UNARYOP with separate kinds for each op it covers, in both the tokenizer and in the parser (with different semantics in each!).  r=dherman, r=cdleary
Crash Signature: [@ js_FindXMLProperty]
Duplicate of this bug: 701247
This should be fixed by the push for bug 701222, which is winding its way through m-i right now.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: js-triage-needed → js-triage-done
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/46b40e2c1953
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.