Closed Bug 640097 Opened 13 years ago Closed 13 years ago

TI: Crash [@ js::types::TypeFailure] with Float64Array, Uint8ClampedArray, ArrayBuffer

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 640098

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

eval("\
  r = Float64Array();\
  y = Uint8ClampedArray(ArrayBuffer);\
  ({4037927940:y[0]})\
")

crashes js debug shell on JM changeset  at js::types::TypeFailure.
Err, JM changeset adc45b0a01c8.
(In reply to comment #1)
> Err, JM changeset adc45b0a01c8.

and with -m, -n and -a.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ js::types::TypeFailure]
A testcase for this bug was already added in the original bug (bug 640098).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.