Closed Bug 460180 Opened 15 years ago Closed 15 years ago

Crash [@ js_FoldConstants] with if (false || false || <x/>)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Assigned: mrbkap)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

Fix
616 bytes, patch
brendan
: review+
Details | Diff | Splinter Review 
js> if (false || false || <x/>) { }

Crash [@ js_FoldConstants]
Attached patch Fix — — Splinter Review 
Assignee: general → mrbkap
Status: NEW → ASSIGNED

        Attachment #343353 -
        Flags: review?(brendan)

    
    

    
  
Comment on attachment 343353 [details] [diff] [review]
Fix

Right. I'm giving you the keys ;-). Close this bug when the fix hits tm -- at least we never bothered m-c with my comedy of errors. Thanks,

/be

        Attachment #343353 -
        Flags: review?(brendan) → review+
Blocks: 460116

    
    

    
  
http://hg.mozilla.org/tracemonkey/rev/49d185d8fef0
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED

    
    

    
  
/cvsroot/mozilla/js/tests/e4x/Regress/regress-460180.js,v  <--  regress-460180.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/6e5c848a2183
Flags: in-testsuite+
Flags: in-litmus-

    
    

    
  
v 1.9.1 tracemonkey and it also passes mozilla-central.
Status: RESOLVED → VERIFIED
Crash Signature: [@ js_FoldConstants]

          You need to log in
          before you can comment on or make changes to this bug.