The default bug view has changed. See this FAQ.

Crash [@ js::LookupPropertyWithFlags] or [@ js_CheckForStringIndex]

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
x86
Mac OS X
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 592337 [details]
stack

function tryItOut(code) {
    f = eval("(function(){" + code + "})")
    try {
        f()
    } catch (e) {}
}
tryItOut("x=7");
tryItOut("\"use strict\";for(d in[x=arguments]){}");
tryItOut("for(v in((Object.seal)(x)));x.length=Function")

crashes js opt shell on m-c changeset 8a59519e137e without any CLI arguments at js::LookupPropertyWithFlags and crashes js debug shell at js_CheckForStringIndex

This seems like a too much recursion crash.
(Reporter)

Comment 1

5 years ago
Fix and test landed in bug 779215. -> RESOLVED / VERIFIED FIXED
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Whiteboard: js-triage-needed
(Reporter)

Updated

5 years ago
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.