Closed Bug 615440 Opened 10 years ago Closed 9 years ago
Method jit crash with "Array
.prototype .__proto __ = null"
./js -m Array.prototype.__proto__ = null; for (var r = 0; r < 3; ++r)  = 1; Crash under js::mjit::EnterMethodJIT, which seems to be a null deref.
Nice. This is definitely my fault, it broke after GetElementIC changes and I've been meaning to file.
Assignee: general → dvander
Status: NEW → ASSIGNED
blocking2.0: --- → betaN+
The first bad revision is: changeset: 85ea6b284b30 user: David Anderson date: Mon Nov 01 11:14:58 2010 -0700 summary: Refactor SETELEM into an IC (bug 607293, r=dmandelin).
10 years ago
Simplifies this code, and makes it look more like the tracer.
Attachment #494178 - Flags: review?(dmandelin)
Comment on attachment 494178 [details] [diff] [review] fix Nice comment, and nice simplification.
Attachment #494178 - Flags: review?(dmandelin) → review+
Whiteboard: [sg:dos] → [sg:dos][fixed-in-tracemonkey]
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug615440.js.
You need to log in before you can comment on or make changes to this bug.