[Webkit-unassigned] [Bug 119447] New: REGRESSION(FTL): Fix mips implementation of ctiVMThrowTrampolineSlowpath

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Fri Aug 2 09:30:03 PDT 2013


https://bugs.webkit.org/show_bug.cgi?id=119447

           Summary: REGRESSION(FTL): Fix mips implementation of
                    ctiVMThrowTrampolineSlowpath
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jbrianceau at nds.com


Crashes are observed during javascriptcore tests. For instance, array-defineOwnProperty.js:

This test checks the behavior of [[DefineOwnProperty]] applied to Array objects (see ES5.1 15.4.5.1).

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS Object.defineProperty([], 'x', { get:function(){return true;} }).x is true
PASS Object.defineProperty([], 'length', { value: 1 }).length is 1
PASS var a = Object.defineProperty([], 'length', { writable: false }); a[1] = 1; a.length is 0
PASS var a = Object.defineProperty([], 'length', { writable: false }); a.length = 1; a.length is 0
PASS var a = Object.defineProperty([], 'length', {}); a.length = 1; a.length is 1
Segmentation fault

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list