Closed Bug 451340 Opened 16 years ago Closed 16 years ago

Crash [@ CheckDestructuring]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

js> function x([y]) { }   
Crash [@ CheckDestructuring]

This kills jsfunfuzz within a second most of the time.
This was a regression from the patch in bug 418051, which has been backed out.
Blocks: 418051
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
/cvsroot/mozilla/js/tests/js1_7/expressions/regress-451340.js,v  <--  regress-451340.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/c908af7dfec5
Flags: in-testsuite+
Flags: in-litmus-
Crash Signature: [@ CheckDestructuring]
You need to log in before you can comment on or make changes to this bug.