Closed
Bug 652185
Opened 13 years ago
Closed 13 years ago
js_XDRRegExpObject needs to anchor the source string
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: igor, Assigned: igor)
References
Details
(Keywords: crash, regression, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
1.03 KB,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
|
Assignee | |
Comment 2•13 years ago
|
||
Luke: could you review this?
|
||
Comment 3•13 years ago
|
||
Would be nice if we could take an Anchored<T> in the same vein as AlreadyIncRefd<T> to categorically prevent this kind of js::RegExp creation error in the future.
|
||
Updated•13 years ago
|
Attachment #527841 -
Flags: review?(luke) → review+
|
|
Assignee | |
Comment 4•13 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/68aa67a995c6
Whiteboard: fixed-in-tracemonkey
|
|
||
Comment 5•13 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/68aa67a995c6
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
||
Updated•9 years ago
|
Group: core-security
|
||
Updated•9 years ago
|
Keywords: regressionwindow-wanted
You need to log in
before you can comment on or make changes to this bug.
Description
•