Closed
Bug 459186
Opened 16 years ago
Closed 16 years ago
Crash [@ CheckDestructuring] with for..in with destructuring and initial value
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9.1b2
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file, 1 obsolete file)
|
989 bytes,
patch
|
gal
:
review-
|
Details | Diff | Splinter Review |
./js
js> for (var [,{y}] = 1 in []) {}
Null deref [@ CheckDestructuring]
Tracemonkey branch. Regression from bug 381843?
|
Assignee | |
Comment 1•16 years ago
|
||
Next step: dependz. :-( /be
Assignee: general → brendan
Attachment #342395 -
Flags: review?(mrbkap)
|
|
Assignee | |
Comment 2•16 years ago
|
||
Fixed in tm: http://hg.mozilla.org/tracemonkey/rev/892e87e5b96c /be
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
|
|
Assignee | |
Comment 3•16 years ago
|
||
Didn't see m-c light of day, thankfully. /be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
||
Updated•16 years ago
|
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
|
|
||
Comment 4•16 years ago
|
||
Attachment #342395 -
Attachment is obsolete: true
Attachment #342397 -
Flags: review?(brendan)
Attachment #342395 -
Flags: review?(mrbkap)
|
|
Assignee | |
Updated•16 years ago
|
Status: REOPENED → RESOLVED
Closed: 16 years ago → 16 years ago
Resolution: --- → FIXED
|
|
||
Updated•16 years ago
|
Attachment #342397 -
Flags: review?(brendan) → review-
|
||
Comment 5•16 years ago
|
||
/cvsroot/mozilla/js/tests/js1_8/regress/regress-459186.js,v <-- regress-459186.js initial revision: 1.1 http://hg.mozilla.org/mozilla-central/rev/b04c04268a94
Flags: in-testsuite+
Flags: in-litmus-
|
||
Updated•13 years ago
|
Crash Signature: [@ CheckDestructuring]
You need to log in
before you can comment on or make changes to this bug.
Description
•