Closed Bug 517117 Opened 15 years ago Closed 15 years ago

TM: Crash with arithmetic on arguments.length that was assigned to

Categories

(Core :: JavaScript Engine, defect, P2)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Tracking Flags:
Tracking Status
status1.9.2 --- beta1-fixed

People

(Reporter: dmandelin, Assigned: dmandelin)

Details

(Keywords: verified1.9.2, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

Patch
6.79 KB, patch
dvander
: review+
Details | Diff | Splinter Review
Attached patch Patch — — Splinter Review 
This is a record-time analogue of bug 516062.
Attachment #401144 - Flags: review?(dvander)
Attachment #401144 - Flags: review?(dvander) → review+
Pushed to TM as 2cdb0f8941bb.
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/2cdb0f8941bb
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/62d26f931cab
status1.9.2: --- → beta1-fixed
Flags: blocking1.9.2+
Priority: -- → P2
js/src/trace-test/tests/basic/setArgumentsLength2.js
v 1.9.3, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: verified1.9.2
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: