If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash [@ SetArrayElement] [@ JSObject::setProperty]

RESOLVED DUPLICATE of bug 513981

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 513981
8 years ago
2 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

({crash})

Trunk
x86
Mac OS X
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:dupe 513981] maybe?, crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

8 years ago
Created attachment 398766 [details]
stack trace

Loading http://sketchup.google.com/3dwarehouse/ crashes my mozilla-central Firefox debug build.
(Reporter)

Updated

8 years ago
(Reporter)

Comment 1

8 years ago
Also happens on TM branch.  I have what I think is a self-contained local testcase and I'm trying to reduce it now.

Comment 2

8 years ago
The test case would be great. This is very likely a dup of 513981, for which we don't have a good test case.
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 513981
(Reporter)

Comment 3

8 years ago
Created attachment 398808 [details]
partially reduced testcase
Whiteboard: [sg:dupe 513981] maybe?
Crash Signature: [@ SetArrayElement] [@ JSObject::setProperty]
Group: core-security
Crash Signature: [@ SetArrayElement] [@ JSObject::setProperty] → [@ SetArrayElement] [@ JSObject::setProperty]
Keywords: testcase-wanted
You need to log in before you can comment on or make changes to this bug.