Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 698902
6 years ago
6 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
x86
Linux
crash, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 570373 [details]
stack

evalcx("\
    for (let i = 0; i < 4; i++) {\
        for (a in ((ArrayBuffer)(46959011)))({});\
        /x/\
    }\
", newGlobal("new-compartment"))

crashes js opt shell on JM changeset b01eb1ba58ce without any CLI arguments at EmptyShape.

(Not sure if this is entirely correct):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79340:ecf776407687
parent:      78973:636842dccfc9
parent:      79339:322354df233d
user:        Brian Hackett
date:        Thu Oct 27 14:16:02 2011 -0700
summary:     Merge MC -> JM
(Reporter)

Comment 1

6 years ago
As per decoder's request, this does not reproduce on m-c changeset 1c7e1db3645b.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 698902
You need to log in before you can comment on or make changes to this bug.