Closed Bug 580915 Opened 14 years ago Closed 14 years ago

JM: Crash [@ js::CheckRedeclaration] or "Assertion failure: obj->isNative(),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

({x:[''].some(gc)}) asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: obj->isNative(), at ../methodjit/StubCalls.cpp:2062 and crashes js opt shell at js::CheckRedeclaration. Program received signal SIGSEGV, Segmentation fault. 0x00000000 in ?? () (gdb) bt #0 0x00000000 in ?? () #1 0x080ab68c in js::CheckRedeclaration(JSContext*, JSObject*, int, unsigned int, JSObject**, JSProperty**) () #2 0x08277288 in ?? () Backtrace stopped: previous frame inner to this frame (corrupt stack?) (gdb) x/i $eip => 0x0: Cannot access memory at address 0x0
Works for me on moo tip 64-bit and 32-bit.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js::CheckRedeclaration]
You need to log in before you can comment on or make changes to this bug.