Closed
Bug 1079850
Opened 10 years ago
Closed 10 years ago
Hit MOZ_CRASH(Types should be in accordance.) at jit/TypePolicy.cpp:872 or Crash [@ js::jit::FilterTypeSetPolicy::adjustInputs]
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla35
Tracking | Status | |
---|---|---|
firefox35 | --- | fixed |
People
(Reporter: decoder, Assigned: h4writer)
References
Details
(Keywords: crash, testcase, Whiteboard: [jsbugmon:update,bisect])
Crash Data
Attachments
(2 files)
992 bytes,
text/plain
|
Details | |
1.51 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase crashes on mozilla-central revision e4cfacb76830 (run with --no-threads --fuzzing-safe --ion-eager): function foo() { for(__key in null) var key=startTest(VERSION) ? this : this; if (key !== undefined) {} } foo();
Reporter | ||
Comment 1•10 years ago
|
||
Reporter | ||
Comment 2•10 years ago
|
||
It looks like the opt-crash also hits a MOZ_CRASH but doesn't output a message (just crashes at NULL). Marked this s-s until triaged because the debug message indicates some form of type mismatch.
status-firefox35:
--- → affected
Whiteboard: [jsbugmon:update,bisect]
Assignee | ||
Comment 4•10 years ago
|
||
This can happen if we haven't seen the type of that branch yet. So we will have to add this code to force a bail here.
Updated•10 years ago
|
Attachment #8501835 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 5•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/790c862b4c2a
Comment 6•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/790c862b4c2a
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in
before you can comment on or make changes to this bug.
Description
•