[Webkit-unassigned] [Bug 119447] New: REGRESSION(FTL): Fix mips implementation of ctiVMThrowTrampolineSlowpath
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Aug 2 09:30:03 PDT 2013
https://bugs.webkit.org/show_bug.cgi?id=119447
Summary: REGRESSION(FTL): Fix mips implementation of
ctiVMThrowTrampolineSlowpath
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: UNCONFIRMED
Severity: Normal
Priority: P2
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: jbrianceau at nds.com
Crashes are observed during javascriptcore tests. For instance, array-defineOwnProperty.js:
This test checks the behavior of [[DefineOwnProperty]] applied to Array objects (see ES5.1 15.4.5.1).
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS Object.defineProperty([], 'x', { get:function(){return true;} }).x is true
PASS Object.defineProperty([], 'length', { value: 1 }).length is 1
PASS var a = Object.defineProperty([], 'length', { writable: false }); a[1] = 1; a.length is 0
PASS var a = Object.defineProperty([], 'length', { writable: false }); a.length = 1; a.length is 0
PASS var a = Object.defineProperty([], 'length', {}); a.length = 1; a.length is 1
Segmentation fault
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list