Last Comment Bug 693894 - NodeList crash [@ js::GetObjectShape]
: NodeList crash [@ js::GetObjectShape]
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla10
Assigned To: Peter Van der Beken [:peterv]
:
: Andrew Overholt [:overholt]
Mentors:
Depends on:
Blocks: 326633 648801
  Show dependency treegraph
 
Reported: 2011-10-11 19:13 PDT by Jesse Ruderman
Modified: 2011-10-14 03:57 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes Firefox when loaded) (127 bytes, text/html)
2011-10-11 19:13 PDT, Jesse Ruderman
no flags Details
stack trace (8.06 KB, text/plain)
2011-10-11 19:13 PDT, Jesse Ruderman
no flags Details
v1 (1.62 KB, patch)
2011-10-12 07:52 PDT, Peter Van der Beken [:peterv]
jst: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2011-10-11 19:13:13 PDT
Created attachment 566418 [details]
testcase (crashes Firefox when loaded)
Comment 1 Jesse Ruderman 2011-10-11 19:13:40 PDT
Created attachment 566419 [details]
stack trace
Comment 2 Peter Van der Beken [:peterv] 2011-10-12 07:52:03 PDT
Created attachment 566529 [details] [diff] [review]
v1
Comment 3 Peter Van der Beken [:peterv] 2011-10-13 07:27:59 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/9e79ba04823e
Comment 4 Ed Morley [:emorley] 2011-10-14 03:57:13 PDT
https://hg.mozilla.org/mozilla-central/rev/9e79ba04823e

Note You need to log in before you can comment on or make changes to this bug.