Closed Bug 640098 Opened 9 years ago Closed 9 years ago

TI: Crash [@ js::types::TypeFailure] with function, eval

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: jandem)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, Whiteboard: fixed-in-jaegermonkey)

Crash Data

Attachments

(1 file)

eval("(function(){({6953421313:0})})")()

crashes js debug shell on JM changeset adc45b0a01c8 at js::types::TypeFailure with -m, -n and -a and shows:

[infer failure] Missing type in object #3:0:Object (index): int

It shows string instead of int if 0 is changed to \"\".
Attached patch PatchSplinter Review
Looks like we're missing a call to typeMonitorAssign in stubs::InitElem (the interpreter has it too)
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #518034 - Flags: review?(bhackett1024)
Attachment #518034 - Flags: review?(bhackett1024) → review+
http://hg.mozilla.org/projects/jaegermonkey/rev/acd2e423b6e1

Followup fix to remove the inference state tracking stack entries which are constant doubles (unlike integers, different doubles can map to different type properties.  This code was fragile (e.g. bug 640078) and in this case wrong (not calling MakeTypeId) and it's simpler to just use dynamic monitoring to catch this oddball case.

http://hg.mozilla.org/projects/jaegermonkey/rev/db22345e7c04
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
Duplicate of this bug: 640097
Crash Signature: [@ js::types::TypeFailure]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug640098.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.