Closed Bug 460180 Opened 13 years ago Closed 13 years ago

Crash [@ js_FoldConstants] with if (false || false || <x/>)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Assigned: mrbkap)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

Fix
616 bytes, patch
brendan
: review+
Details | Diff | Splinter Review 
js> if (false || false || <x/>) { }

Crash [@ js_FoldConstants]
Attached patch Fix — — Splinter Review
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #343353 - Flags: review?(brendan)
Comment on attachment 343353 [details] [diff] [review]
Fix

Right. I'm giving you the keys ;-). Close this bug when the fix hits tm -- at least we never bothered m-c with my comedy of errors. Thanks,

/be
Attachment #343353 - Flags: review?(brendan) → review+
Blocks: 460116
http://hg.mozilla.org/tracemonkey/rev/49d185d8fef0
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
/cvsroot/mozilla/js/tests/e4x/Regress/regress-460180.js,v  <--  regress-460180.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/6e5c848a2183
Flags: in-testsuite+
Flags: in-litmus-
v 1.9.1 tracemonkey and it also passes mozilla-central.
Status: RESOLVED → VERIFIED
Crash Signature: [@ js_FoldConstants]
You need to log in before you can comment on or make changes to this bug.