__proto__ = <x/>; <x/>.lastIndexOf(this, false) I found and reduced to the testcase above, it crashes latest trunk js shell, both opt and debug at null. 1.9.0.x js shell works as expected, which shows the message "typein:1: TypeError: XML.prototype.toString called on incompatible global".

The typos were introduced by the patch for bug 412296.

Comment on attachment 334108 [details] [diff] [review] Fix Sorry about the typos.

For the purpose of automated testing, here is another crash testcase involving IndexOf instead of lastIndexOf: __proto__ = <x/>; <x/>.indexOf(this) A similar crash that crashes at null and at str_indexOf.

Verifying in both opt and debug js shells. They now work as expected. Console output: $ ./js-trunk-intelmac js> __proto__ = <x/>; <x/>.lastIndexOf(this, false) typein:1: TypeError: XML.prototype.toString called on incompatible global js> __proto__ = <x/>; <x/>.indexOf(this) typein:2: TypeError: XML.prototype.toString called on incompatible global js>

/cvsroot/mozilla/js/tests/e4x/extensions/regress-450871-01.js,v <-- regress-450871-01.js initial revision: 1.1 /cvsroot/mozilla/js/tests/e4x/extensions/regress-450871-02.js,v <-- regress-450871-02.js initial revision: 1.1 http://hg.mozilla.org/mozilla-central/rev/a4ac2862212d