307317
|
|
JS engine assert when running with WAY_TOO_MUCH_GC
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2006-03-12
|
308085
|
|
JavaScript switch statement going to wrong case
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2006-03-12
|
309712
|
|
HTML-style comments in the middle of .js file cause part of script to be ignored (treated as XML data)
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2006-03-12
|
309852
|
|
E4X - JS_ASSERT @ js_Interpret, line 5070
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2005-10-08
|
310425
|
|
Array.indexOf/lastIndexOf is broken for corner cases
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2011-08-05
|
310993
|
|
HTML comment on JS if() causes erroneous results
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2006-07-03
|
312064
|
|
E4X - XML Initializers with CDATA sections
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2005-10-26
|
313080
|
|
<xml/>.__proto__() causes crash [@ obj_getSlot]
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2005-10-21
|
313684
|
|
getting clone-parent of JS function using Array generic methods
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2006-11-10
|
226094
|
|
Support JavaScript Core for WinXP AMD64
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2005-11-02
|
312196
|
|
Trouble extending E4X XML objects with __noSuchMethod__ (e4x/extensions/regress-312196.js)
|
Core
|
JavaScript Engine
|
brendan
|
RESO
|
FIXE
|
2011-08-05
|
309894
|
|
Avoid nested js_Interpret for XML filtering predicate expression
|
Core
|
JavaScript Engine
|
igor
|
RESO
|
FIXE
|
2008-02-29
|
1219532
|
|
Resolve Firefox 41.0.2 build error on MIPS platform. Because jit::PatchJump function overwrite
|
Core
|
JavaScript Engine: J
|
hwjeastd07
|
RESO
|
WORK
|
2021-02-05
|
320483
|
|
A javascript one-line snippet that hangs firefox
|
Core
|
JavaScript Engine
|
general
|
RESO
|
DUPL
|
2014-01-16
|
758868
|
|
Javascript interpreter should not remove extra code blocks
|
Core
|
JavaScript Engine
|
general
|
RESO
|
INVA
|
2012-06-16
|
307795
|
|
Add Object.hashcode and Object.identical
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INVA
|
2017-11-10
|
309977
|
|
nsIDOMWindowInternal.alert, NS_ERROR_FAILURE, Component returned failure code: 0x80004005
|
Firefox
|
General
|
nobody
|
RESO
|
WORK
|
2005-09-26
|
370369
|
|
Simple string-doubling loop causes Firefox 1.0-3.0b2 to take up 100% CPU and 100% RAM
|
Firefox
|
General
|
nobody
|
RESO
|
INCO
|
2010-05-22
|
379989
|
|
Array.every and Array.some do not behave consistently with empty arrays
|
Firefox
|
General
|
nobody
|
RESO
|
INVA
|
2007-05-07
|
469491
|
|
Browser crashes on opening a site containing java script (js).
|
Firefox
|
General
|
nobody
|
RESO
|
WORK
|
2008-12-14
|
906250
|
|
All sites, and plugins, add-ons and all javascripts on Firefox are not reading.
|
Firefox
|
Untriaged
|
nobody
|
RESO
|
WORK
|
2013-08-18
|
955670
|
|
Indexed property enumeration order is not numeric for indices larger than 1000
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
DUPL
|
2014-01-09
|
1219526
|
|
Implement ES6 NewTarget on mips platform. same as Bug 1141865
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INVA
|
2022-05-30
|
306664
|
|
Bump JS version to 1.6, for E4X + Array extra + Array/String generics
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-08-05
|
307273
|
|
Locking doesn't always add objects to rt->gcLocksHash
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
INVA
|
2005-09-06
|
307315
|
|
JS labeled as version 1.6 does't work
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-03-12
|
309242
|
|
E4X should be on by default, while preserving the comment hiding hack
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2010-05-29
|
309695
|
|
Crash visiting msdn.microsoft.com [@ js_FreeAtomMap]
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-05-10
|
311157
|
|
Comment-hiding compromise left E4X parsing/scanning inconsistent
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-08-14
|
311161
|
|
toSource() exposes random memory or crashes [@ memcpy] [@ js_obj_toSource]
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
DUPL
|
2011-06-13
|
313153
|
|
generic native method dispatcher botches extra actual arguments
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-02-18
|
313276
|
|
Unrooted strings in jsstr.c
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-08-05
|
313479
|
|
Unrooted access in jsnum.c
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-08-05
|
313500
|
|
Unrooted access to "prototype" property
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-08-05
|
313763
|
|
Extra rootless creatures in jsarray.c
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-06-14
|
313799
|
|
E4X: Assertion failure: !JSVAL_IS_PRIMITIVE(v), at jsxml.c:5558
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2005-11-01
|
313952
|
|
Unrooted access in jsxml.c
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-06-14
|
314887
|
|
crash if I open this site [@ js_GetGCThingFlags]
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-06-09
|
316885
|
|
CVE-2006-0292 Unrooted access in jsinterp.c
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-04-18
|
319391
|
|
"eval('...') = ..." gives "invalid assignment lefthand side" as a compile-time error instead of as a runtime error
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-08-05
|
320032
|
|
Parenthesization dereferences ECMA Reference type, incorrectly
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-01-12
|
321549
|
|
E4X: inconsistencies in the use of {} syntax
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-07-07
|
321971
|
|
JSOP_FINDNAME replaces JSOP_BINDNAME, does not prefix it
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-07-07
|
323529
|
|
non-minimum-sized GC arena pools have wrong alignment modulus
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-11-10
|
311792
|
|
Unrooted access in Array.prototype methods
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2006-06-14
|
311025
|
|
chrome XBL method.eval.call exposes privileged Function constructor
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-11-10
|
316862
|
|
'Disassemble to bytecode' is a bit broken
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-07-07
|
311580
|
|
Crash in [@ js_AppendJSString] appending 30,000 <li> elements to an <ol> via E4X.
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-08-05
|
313630
|
|
Unrooted access in js_fun_toString
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-06-14
|
307456
|
|
Freeze when certain Javascript regular expressions are executed; should warn about long-running script
|
Core
|
JavaScript Engine
|
feng.qian.moz
|
VERI
|
FIXE
|
2013-02-23
|
313938
|
|
Unrooted access in jsscript.c
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2006-06-14
|
308806
|
|
Object.prototype.toLocaleString() wrong
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-04-09
|
312385
|
|
String.indexOf(arg, pattern) should convert arg to string
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
INVA
|
2006-04-25
|
315797
|
|
js_Interpret uses undefined variables on recursion error
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-01-14
|