Closed
Bug 698123
Opened 13 years ago
Closed 13 years ago
Crash [@ EmptyShape]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 698902
People
(Reporter: gkw, Unassigned)
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file)
|
5.25 KB,
text/plain
|
Details |
evalcx("\
for (let i = 0; i < 4; i++) {\
for (a in ((ArrayBuffer)(46959011)))({});\
/x/\
}\
", newGlobal("new-compartment"))
crashes js opt shell on JM changeset b01eb1ba58ce without any CLI arguments at EmptyShape.
(Not sure if this is entirely correct):
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 79340:ecf776407687
parent: 78973:636842dccfc9
parent: 79339:322354df233d
user: Brian Hackett
date: Thu Oct 27 14:16:02 2011 -0700
summary: Merge MC -> JM
|
Reporter | |
Comment 1•13 years ago
|
||
As per decoder's request, this does not reproduce on m-c changeset 1c7e1db3645b.
|
||
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•