Closed
Bug 643242
Opened 15 years ago
Closed 15 years ago
TI: Crash [@ js::PutEscapedStringImpl] or [@ js::types::CondenseSweepTypeSet]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 643243
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
{
function newSandbox(n) {}
}
var o12 = Float32Array.prototype;
function f12(o) {
eval('o')['__proto_' + '_'] = null;
}
for (var i = 0; i < 14; i++) {
gc()
new f12(o12);
}
crashes js debug shells on JM changeset 5ce2f7a90286 with -m, -a and -n at js::PutEscapedStringImpl and crashes js opt shells at js::types::CondenseSweepTypeSet when passed in as a CLI argument.
This was found using a combination of jsfunfuzz and jandem's method fuzzer.
|
Reporter | |
Updated•15 years ago
|
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
|
||
Updated•14 years ago
|
Crash Signature: [@ js::PutEscapedStringImpl]
[@ js::types::CondenseSweepTypeSet]
|
||
Comment 2•13 years ago
|
||
A testcase for this bug was already added in the original bug (bug 643243).
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•