Closed
Bug 580885
Opened 14 years ago
Closed 14 years ago
JM: Crash [@ js::ExecuteFrameGuard::~ExecuteFrameGuard] or "Assertion failure: origin != destination,"
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: gkw, Unassigned)
References
Details
(4 keywords)
Crash Data
with(evalcx('')) {
eval("for(z in[0]){}")
}
asserts js debug shell on JM changeset 7c6f62fcbd91 without -m or -j at Assertion failure: origin != destination, at ../jswrapper.cpp:509 and crashes js opt shell at js::ExecuteFrameGuard::~ExecuteFrameGuard
Program received signal SIGSEGV, Segmentation fault.
0x0806de6d in js::ExecuteFrameGuard::~ExecuteFrameGuard() ()
(gdb) bt
#0 0x0806de6d in js::ExecuteFrameGuard::~ExecuteFrameGuard() ()
#1 0x082786b0 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/i $eip
=> 0x806de6d <_ZN2js17ExecuteFrameGuardD1Ev+29>: movl $0x0,(%edx)
|
||
Comment 1•14 years ago
|
||
Works for me on moo tip 64-bit and 32-bit.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
|
||
Updated•14 years ago
|
Crash Signature: [@ js::ExecuteFrameGuard::~ExecuteFrameGuard]
You need to log in
before you can comment on or make changes to this bug.
Description
•