Closed
Bug 461932
Opened 16 years ago
Closed 16 years ago
Crash [@ nanojit::LIns::isop] with generator, NaN
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.1b2
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file)
|
1.41 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
function gen() { for (var j = 0; j < 4; ++j) { NaN; yield 3; } }
for (let i in gen()) { }
Crash [@ nanojit::LIns::isop]
|
Assignee | |
Updated•16 years ago
|
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
|
|
Assignee | |
Comment 2•16 years ago
|
||
I will investigate fixing generators for good before going with this. /be
Attachment #345175 -
Flags: review?(danderson)
|
||
Updated•16 years ago
|
Attachment #345175 -
Flags: review?(danderson) → review+
|
|
Assignee | |
Comment 3•16 years ago
|
||
Fixed by the patch for bug 456511 (imacros FTW!). /be
Depends on: imacros
|
|
Assignee | |
Comment 4•16 years ago
|
||
Bug 456511 has the fix. /be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
||
Comment 5•16 years ago
|
||
test landed http://hg.mozilla.org/mozilla-central/rev/c7d686d5ec4c and cvs
Flags: in-testsuite+
Flags: in-litmus-
|
||
Updated•13 years ago
|
Crash Signature: [@ nanojit::LIns::isop]
You need to log in
before you can comment on or make changes to this bug.
Description
•