Closed
Bug 698123
Opened 13 years ago
Closed 13 years ago
Crash [@ EmptyShape]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 698902
People
(Reporter: gkw, Unassigned)
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file)
5.25 KB,
text/plain
|
Details |
evalcx("\ for (let i = 0; i < 4; i++) {\ for (a in ((ArrayBuffer)(46959011)))({});\ /x/\ }\ ", newGlobal("new-compartment")) crashes js opt shell on JM changeset b01eb1ba58ce without any CLI arguments at EmptyShape. (Not sure if this is entirely correct): autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 79340:ecf776407687 parent: 78973:636842dccfc9 parent: 79339:322354df233d user: Brian Hackett date: Thu Oct 27 14:16:02 2011 -0700 summary: Merge MC -> JM
Reporter | ||
Comment 1•13 years ago
|
||
As per decoder's request, this does not reproduce on m-c changeset 1c7e1db3645b.
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•