Summary: | REGRESSION: Javascript attempt to access non-existent array elements crashes | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Kevin Broderick <kbroderick> | ||||||
Component: | JavaScriptCore | Assignee: | Maciej Stachowiak <mjs> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Critical | CC: | mrowe | ||||||
Priority: | P2 | ||||||||
Version: | 420+ | ||||||||
Hardware: | Mac | ||||||||
OS: | OS X 10.4 | ||||||||
URL: | http://online.wsj.com/public/article/0,,SB112311985732004654-x3qD8ODU_jwTvTplbvV6uhXfyBc_20060803,00.html?mod=blogs | ||||||||
Attachments: |
|
Description
Kevin Broderick
2005-08-04 11:52:03 PDT
Created attachment 3226 [details]
Reduction
This two-line Javascript, when included, will crash ToT webkit.
Confirmed as a regression from system WebKit with ToT. Created attachment 3252 [details]
Reduction wrapped in HTML for easy testing
This bug is no longer reproducible in 416.11 or ToT, and was most likely fixed in a previous update. |