Closed Bug 785805 Opened 8 years ago Closed 8 years ago

Segmentation fault when calling %ThrowError for message with three arguments

Categories

(Core :: JavaScript Engine, defect)

Other Branch
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla18

People

(Reporter: mozillabugs, Assigned: mozillabugs)

References

(Blocks 1 open bug)

Details

Attachments

(2 files, 1 obsolete file)

Using the %ThrowError intrinsic from self-hosted code causes a segmentation fault if formatting a message with three arguments.
Attached patch proposed patch (obsolete) — Splinter Review
After building with this patch, use the shell to run

    [].testThrowError();

This should throw an exception with the strings "arg 1", "arg 2", "arg 3" embedded in the message. It should not cause a segmentation fault.
Assignee: general → mozillabugs
Status: NEW → ASSIGNED
Attached patch proposed patchSplinter Review
Rebased to current mozilla-central, which did change the changed line (from int to unsigned), and improved the commit message.
Attachment #655534 - Attachment is obsolete: true
Attachment #656312 - Flags: review?(jorendorff)
Comment on attachment 656312 [details] [diff] [review]
proposed patch

Review of attachment 656312 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing review
Attachment #656312 - Flags: review?(jorendorff) → review+
https://hg.mozilla.org/mozilla-central/rev/67c5a4852b9f
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in before you can comment on or make changes to this bug.