Created attachment 337265 [details] crash log this.__defineGetter__("x", Function); this.__defineSetter__("x", Function); this.watch("x", x.__proto__); x = 1; crashes both opt and debug 1.8.1.x and 1.9.0.x js shells at null.
mrbkap fixed this on mozilla-central; he'll know the bug number, or you can find it by hg annotating and logging jsobj.cpp in js_ComputeFilename. /be
Is it bug 419848 ? (I did a search for hg annotate js_ComputeFilename is jsobj.cpp) That bug was checked in for branch though...
No, the bug in question is bug 452295. All new work in the JS engine happens in the .cpp files (not .c).
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 452295
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-454040.js,v <-- regress-454040.js initial revision: 1.1 http://hg.mozilla.org/mozilla-central/rev/f0e9fd501e63
verified 1.9.1, 1.9.0, 1.8.1 test passes.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.