Closed
Bug 1316841
Opened 8 years ago
Closed 8 years ago
Assertion failure: "[infer failure] Missing type in object" when subclassing String and deleting length property
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 1299098
| Tracking | Status | |
|---|---|---|
| firefox52 | --- | affected |
People
(Reporter: anba, Unassigned)
Details
https://treeherder.mozilla.org/#/jobs?repo=try&revision=c7e451809acd7de425a714fe4e99445f0c7d6c5b&selectedJob=30891653
Crashes with assertion failure:
---
Assertion failure: [infer failure] Missing type in object [String * 0x7f35e1e779d0] length: int, at /home/andre/hg/mozilla-inbound/js/src/vm/TypeInference.cpp:256
---
Reduced test case:
---
class S extends String {}
var s1 = new S();
print(s1.length);
delete s1.length;
var s2 = new S('test262');
print(s2.length);
---
Marked as s-s per evilpie's recommendation.
|
||
Updated•8 years ago
|
Group: core-security → javascript-core-security
|
||
Comment 1•8 years ago
|
||
Same issue as bug 1299098.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
|
|
||
Updated•6 years ago
|
Group: javascript-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•