Closed
Bug 657986
Opened 13 years ago
Closed 13 years ago
TI: Crash [@ js::types::TypeFailure] involving missing type in object Global i: #4:15:Array
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
function f(x) { this.i = x; } for each(let e in [0, 0, []]) { try { f(e) } catch (e) {} } print(uneval(this)) crashes js debug shell on JM changeset 5d1cbc94bc42 with -m, -a and -n at js::types::TypeFailure with the message: [infer failure] Missing type in object Global i: #4:15:Array
Comment 1•13 years ago
|
||
WFM on tip, possibly fixed by rev 29bd8523ead9. Can you still repro?
Reporter | ||
Comment 2•13 years ago
|
||
WFM on tip too - but marking FIXED since a possible fix changeset is noted.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Updated•13 years ago
|
Crash Signature: [@ js::types::TypeFailure]
Comment 3•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•