782089 - Reflect.parse crash with loc:false

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Thaddee Tyl [:espadrine]]

Attachment: Backtrace

Always reproducible.

1. Paste the following in the scratchpad:

      Components.utils.import("resource://gre/modules/reflect.jsm");
      let sc = "n = 0\n/0?\":n\/\//.test(n + '\":n//')";
      Reflect.parse(sc, {loc:false});

  The actual source string parsed does not matter.

2. Put the scratchpad in Chrome mode (Environment > Chrome, or Ctrl-N, Ctrl-B).

3. Run it (Ctrl-L).


It causes an immediate crash with the following error:

Assertion failure: isNative(), at /home/tyl/files/cloud/fx-team/js/src/vm/ObjectImpl.cpp:263

The backtrace is attached.

Comment 1

[Dave Herman [:dherman]]

I can't reproduce in Nightly. Are you still seeing this?

Dave

Comment 2

[Thaddee Tyl [:espadrine]]

I just updated my tree and recompiled it, the crash still occurs.

I tried it on Linux and Mac, they both caused a crash.

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.