assertion, crash, regression, verified22.214.171.124, verified1.9.1
Created attachment 373485 [details] [diff] [review] Patch
Attachment #373485 - Flags: review?(jorendorff)
I looked at the other failures, and they're all from push with an index that the test expects to wrap around but which doesn't, and then the push fails when the final length-set is attempted.
Comment on attachment 373485 [details] [diff] [review] Patch Someday, once we're out from under LiveConnect's dependence on C headers, I hope we'll have a JSArray type (derived from JSObject, no virtual methods, just for type safety), and this kind of thing will be rarer.
Attachment #373485 - Flags: review?(jorendorff) → review+
Whiteboard: [sg:critical?] → [sg:critical?] fixed-in-tracemonkey
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
Needed in 1.9.0.x if we take bug 465980
Whiteboard: [sg:critical?] fixed-in-tracemonkey → [sg:critical?][1.9.0 patch in bug 465980] fixed-in-tracemonkey
Bob, can you verify this for 126.96.36.199?
v 1.9.0, 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed188.8.131.52, fixed1.9.1 → verified184.108.40.206, verified1.9.1
http://hg.mozilla.org/tracemonkey/rev/2bedd496fa14 /cvsroot/mozilla/js/tests/ecma_3/Array/regress-488989.js,v <-- regress-488989.js initial revision: 1.1
You need to log in before you can comment on or make changes to this bug.