Bug 35730 – Crashes after delete Array.prototype

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: JavaScriptCore

[Peter Leonov]

This simplified test case crashes Safari 4.0.4 on my old Intel Mac (Core Duo, iMac 4,1) with all updates installed.
In the latest nightly build all is OK. On a new iMac with Core 2 Duo Safari does not crash at all ;)

[Peter Leonov]

Cut from that page:

function blablabla (m)
{
	[].push()
	m.constructor === Array
}

function crash ()
{
	Array.prototype.xxx6 = 123
	blablabla(123)
	delete Array.prototype.xxx6
	blablabla([])
	
	new Array().join()
	
	{
		[].sort()
	}
}

crash()

[Xan Lopez]

I don't get a crash with ToT with that code.

[Gavin Barraclough]

Works for me too.