Bug 17925
| Summary: | Crash in KJS::JSObject::put after setting this.__proto__ | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Jesse Ruderman <jruderman> |
| Component: | JavaScriptCore | Assignee: | Mark Rowe (bdash) <mrowe> |
| Status: | RESOLVED FIXED | ||
| Severity: | Critical | CC: | eric, mjs |
| Priority: | P2 | Keywords: | HasReduction, InRadar |
| Version: | 528+ (Nightly build) | ||
| Hardware: | Mac | ||
| OS: | OS X 10.5 | ||
| Bug Depends on: | |||
| Bug Blocks: | 13638 | ||
Jesse Ruderman
Feeding this script to ToT Release/testkjs makes it crash.
this.__proto__ = 1; r = 2;
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Mark Rowe (bdash)
<rdar://problem/5806428>
Mark Rowe (bdash)
Fixed in r31145.
Anders Carlsson
Reopening this since it still happens.
Anders Carlsson
Committed revision 34160.