[Webkit-unassigned] [Bug 11073] REGRESSION (r16606): javascriptCore Crash on website load

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=11073


opendarwin.org at mitzpettel.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|REGRESSION (r16606-r16607): |REGRESSION (r16606):
                   |javascriptCore Crash on     |javascriptCore Crash on
                   |website load                |website load




------- Comment #2 from opendarwin.org at mitzpettel.com  2006-09-27 23:37 PDT -------
+    for (Vector<Parameter>::iterator it = &(params[index+1]); it <
params.end(); it++)

index + 1 can be out of bounds.


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.