There is a small bug in js_ReportUncaughtException(). Some exceptions, when triggered cause the following to be output: JSERROR: can't convert Error to string Flags: (Error number: 38) JSERROR: CorruptScript2.js line 207: unknown (can't convert to string) Flags: EXCEPTION The JSErrorReport stored in reportp originally says "n is not a function" for exception, the but this message is wiped out replace with above message. In the call to js_ValueToString in jsexn.c (shown below), str is being set to null, which causes this problem. ------------- reportp = js_ErrorFromException(cx, exn); /*XXX L10N angels cry once again (see also jsemit.c, /L10N gaffes/) */ str = js_ValueToString(cx, exn); if (!str) { bytes = "unknown (can't convert to string)"; ------------- I will be uploading a tester application that can be used to reproduce the problem. This is a VC++ 6.0 project file with supporting cpp's and headers. The sources should compile on Linux (leave out WIN32 stackwalk related files). Linux guys supply our own make file. Note: The root problem which causes the exception is related to loss of a class constructor an object is rooted and re-used between two different threads on two different JSContexts. We are addressing this with other remedies. Either way, the exception handling mechanism should report the real exception that is occuring. If you set a breakpoint on: str = js_ValueToString(cx, exn); you should see the problem after the 2nd execution of SCRIPT_2 in the tester app. I do have a patch with hacks around problem but I doubt it would be acceptable for general release...

WIN32 guys: I couldn't upload the required dbghelp.dll since it makes the attachment too big. Feel free to disable the stackwalking related code. This is not necessary to reproduce the bug. P.S. The scripts we are running are ugly and so it the code. We are simply trying to reproduce the problem...with no other concerns. :-)

More info... If you increase the number of threads running in main() to a higher number it will crash the JS engine too. Look for this line in main() and change X to 10 or something: if(GetTotalThreadCount() < X)

Dup'ing forward, the newer bug has the fix. Sorry this took too long. /be *** This bug has been marked as a duplicate of 350650 ***

This bug is still happening. Not sure this is a duplicate of 350650. Right now I've got a simple script mistake is a JS script (missing a comma) that is causing this every time. Extremely easy to reproduce. The root of the problem is that js_ValueToString() as described in 1st comment is calling js_DefaultValue() which is throwing another error when it calls: js_ReportValueError2(cx, JSMSG_CANT_CONVERT_TO, ....) Call stack is below: ---------------------- MWScriptErrorHandler(JSContext * pContext=0x035bc238, const char * message=0x031b0660, JSErrorReport * report=0x03d0ed98) Line 2516 C++ js_ReportErrorAgain(JSContext * cx=0x035bc238, const char * message=0x034cca40, JSErrorReport * reportp=0x03d0ed98) Line 1239 + 0x15 bytes C ReportError(JSContext * cx=0x035bc238, const char * message=0x034cca40, JSErrorReport * reportp=0x03d0ed98) Line 857 + 0x11 bytes C js_ReportErrorNumberVA(JSContext * cx=0x035bc238, unsigned int flags=0, const JSErrorFormatString * (void *, const char *, const unsigned int)* callback=0x10113520, void * userRef=0x00000000, const unsigned int errorNumber=38, int charArgs=1, char * ap=0x03d0ee08) Line 1189 + 0x11 bytes C JS_ReportErrorFlagsAndNumber(JSContext * cx=0x035bc238, unsigned int flags=0, const JSErrorFormatString * (void *, const char *, const unsigned int)* errorCallback=0x10113520, void * userRef=0x00000000, const unsigned int errorNumber=38, ...) Line 5495 + 0x1f bytes C js_ReportValueErrorFlags(JSContext * cx=0x035bc238, unsigned int flags=0, const unsigned int errorNumber=38, int spindex=1, long v=64098784, JSString * fallback=0x03d130e0, const char * arg1=0x101e5650, const char * arg2=0x00000000) Line 1297 + 0x24 bytes C js_DefaultValue(JSContext * cx=0x035bc238, JSObject * obj=0x03d211e0, JSType hint=JSTYPE_STRING, long * vp=0x03d0ee8c) Line 4086 + 0x39 bytes C js_ValueToString(JSContext * cx=0x035bc238, long v=64098784) Line 2694 + 0x1b bytes C js_ReportUncaughtException(JSContext * cx=0x035bc238) Line 1301 + 0xd bytes C JS_CompileUCScriptForPrincipals(JSContext * cx=0x035bc238, JSObject * obj=0x00000000, JSPrincipals * principals=0x00000000, const unsigned short * chars=0x034b9580, unsigned int length=1734, const char * filename=0x031cdf08, unsigned int lineno=1) Line 4536 + 0x32 bytes C JS_CompileUCScript(JSContext * cx=0x035bc238, JSObject * obj=0x00000000, const unsigned short * chars=0x034b9580, unsigned int length=1734, const char * filename=0x031cdf08, unsigned int lineno=1) Line 4506 + 0x1f bytes C ------------------- Here's the part of the script that causes the error because of missing comma on 3rd constant: ----------------- var ERRORS = { INVALID_USER_PASS : "Invalid username or password.", UNKNOWN_STORE : "Unknown Store #", ACCESS_DENIED : "Access denied to Store #" AUTH_ERROR : "Internal error. Access denied" } ---------------------

Close bug again. Bug in global resolver hook prevented some exception and error class/prototypes from being lazily resolved as they should have been. But is now gone.