Closed Bug 488272 Opened 16 years ago Closed 16 years ago

Crash [@ RebindLets]

Categories

(Core :: JavaScript Engine, defect, P2)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9.2a1

People

(Reporter: gkw, Assigned: brendan)

References

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(1 file, 1 obsolete file)

null defense without regression, what a concept
(deleted), patch
mrbkap
: review+
Details | Diff | Splinter Review
if((y for (w in 0)) for each (x in 0)) {for(let z = y in crashes opt and dbg js shell without -j at RebindLets at null. autoBisect-ing soon...
Flags: blocking1.9.1?
autoBisect shows this is probably related to bug 452498: The first bad revision is: changeset: 26784:2cf0bbe3772a user: Brendan Eich date: Sun Apr 05 21:17:22 2009 -0700 summary: upvar2, aka the big one take 2 (452598, r=mrbkap). I just noticed the bug number for the checkin message is wrong. (See http://hg.mozilla.org/tracemonkey/rev/2cf0bbe3772a ). Filed bug 488276 to change it (if it's possible).
Blocks: upvar2
Keywords: regression
OS: Mac OS X → All
Hardware: x86 → All
Assignee: general → brendan
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla1.9.1b4
Attached patch trivial null defense required here (obsolete) (deleted) — — Splinter Review
Attachment #372646 - Flags: review?(mrbkap)
Attachment #372646 - Flags: review?(mrbkap) → review+
Fixed in tm: http://hg.mozilla.org/tracemonkey/rev/50427c373190 /be
Whiteboard: fixed-in-tracemonkey
This bug's patch regressed js1_8_1/regress/regress-452498-130.js Backing out, please do not merge to m-c or 1.9.1: http://hg.mozilla.org/tracemonkey/rev/dbc3adcff753 /be
Whiteboard: fixed-in-tracemonkey
Attachment #372646 - Attachment is obsolete: true
Attachment #372748 - Flags: review?(mrbkap)
Attachment #372748 - Flags: review?(mrbkap) → review+
Fixed for sure in tm: http://hg.mozilla.org/tracemonkey/rev/389cade4e21f /be
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/389cade4e21f
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the following debug builds: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422224452 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
Target Milestone: mozilla1.9.1b4 → mozilla1.9.2a1
Flags: in-testsuite?
Crash Signature: [@ RebindLets]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: