Closed
Bug 648919
Opened 13 years ago
Closed 13 years ago
CallJSPropertyOp incorrectly called with obj instead of receiver in Shape::get
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gal, Assigned: gal)
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
1.95 KB,
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
No description provided.
|
Assignee | |
Comment 1•13 years ago
|
||
Assignee: general → gal
|
||
Comment 2•13 years ago
|
||
Comment on attachment 525009 [details] [diff] [review] patch Needs a test. r=me with that.
Attachment #525009 -
Flags: review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
jorendorff said to push without test while we think about how the hell to test this http://hg.mozilla.org/tracemonkey/rev/d014f4c16b85
Whiteboard: fixed-in-tracemonkey
|
||
Comment 4•13 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/d014f4c16b85
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•