Closed
Bug 655711
Opened 13 years ago
Closed 13 years ago
TI: [infer failure] Missing type at #2500:00066 pushed 0: Unique:new
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
|
1.38 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
This is causing M1, M2, Moth failures. JSOP_THIS pushes this value: -- object 0x21631048 class 0x2269880 Proxy flags: delegate proto <XPC_WN_ModsAllowed_NoCall_Proto_JSClass object at 0x1c6781c0> parent <Window object at 0x1fd051f8> not native -- And the expected type is object[1] Global. Only happens with JM enabled.
|
Assignee | |
Updated•13 years ago
|
Assignee: general → jandemooij
Status: NEW → ASSIGNED
|
|
Assignee | |
Comment 1•13 years ago
|
||
jsop_this would push the outer window if |this| is undefined or null, but script->getGlobalType() referred to the inner window. The fix, as discussed on IRC, is to mark the resulting type as unknown in this case. Correct me if I'm wrong.
Attachment #531124 -
Flags: review?(bhackett1024)
|
||
Updated•13 years ago
|
Attachment #531124 -
Flags: review?(bhackett1024) → review+
|
|
Assignee | |
Comment 2•13 years ago
|
||
http://hg.mozilla.org/projects/jaegermonkey/rev/cb9c34a8b2b4
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•