760044 - crash in js::ToStringSlow

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

This bug was filed from the Socorro interface and is 
report bp-140198a9-d026-4775-9513-8ef072120530 .
============================================================= 
found on the Firefox 14a2 Crash Report - no comments so far


Crashing Thread
Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::ToStringSlow 	js/src/jsstr.cpp:3289
1 	mozjs.dll 	js::NativeIterator::allocateIterator 	js/src/jsiter.cpp:554
2 	mozjs.dll 	VectorToKeyIterator 	js/src/jsiter.cpp:602
3 	mozjs.dll 	js::EnumeratedIdVectorToIterator 	js/src/jsiter.cpp:671
4 	mozjs.dll 	js::ProxyHandler::iterate 	js/src/jsproxy.cpp:284
5 	mozjs.dll 	js::Proxy::iterate 	js/src/jsproxy.cpp:905
6 	mozjs.dll 	js::GetIterator 	js/src/jsiter.cpp:780
7 	mozjs.dll 	js::ValueToIterator 	js/src/jsiter.cpp:919
8 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2071
9 	mozjs.dll 	js::ContextStack::pushInvokeFrame 	js/src/vm/Stack.cpp:783
10 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:535
11 	mozjs.dll 	mozjs.dll@0x8cbf

Comment 1

[Sebastian Zartner [:sebo]]

We have a related Firebug report plus reproducible test case:

http://code.google.com/p/fbug/issues/detail?id=5712

Sebastian

Comment 2

[Sebastian Zartner [:sebo]]

I tested right now with the Beta, Aurora and Nightly versions of Firefox and it seems to be already fixed in Aurora and Nightly.

Sebastian

Comment 4

[Sebastian Zartner [:sebo]]

If somebody considers this to fix this for Firefox 14, there's a simplified test case described in http://code.google.com/p/fbug/issues/detail?id=5751.

Sebastian

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Closing because no crashes reported for 12 weeks.