Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 14 years ago

function f() {
    (function () {
        x;
        function a() {}
        print(a)
    })()
}
__defineGetter__("x", gc)
f()

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: isObjectOrNull(), at ../../jsvalue.h:536 and crashes js opt shell at js_TryMethod.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x080c6471 in js_TryMethod(JSContext*, JSObject*, JSAtom*, unsigned int, js::Value*, js::Value*) ()
#2  0x08277288 in ?? ()
#3  0x00000000 in ?? ()
(gdb) x/i $eip
=> 0x0:	Cannot access memory at address 0x0

	Andrew Drake [:adrake]
	Comment 1 • 14 years ago

Works for me on moo tip 64-bit and 32-bit.

	Christian Holler (:decoder)
	Comment 2 • 12 years ago

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929