Closed Bug 642307 Opened 9 years ago Closed 9 years ago

TI: [infer failure] Missing type at #5:00018 pushed 0: int

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, testcase)

Attachments

(1 file)

The attached test case (unpack, chdir and run main.js with -n -m) crashes on
TI tip (tested on 64 bit). I wasn't able to condense this into a single file so far.
Cool test case!  To help some with -a, inference will try to resolve standard classes as it sees them.  This requires that such resolving does not reenter the interpreter (something we should assert).  This test case prevents extensions on the global object so the resolving throws (which is in itself a TM bug, filed as bug 642559), and also makes a toSource on the global so that constructing the exception reenters the interpreter.
Depends on: 642559
Duplicate of this bug: 642988
Duplicate of this bug: 643279
Duplicate of this bug: 645301
Duplicate of this bug: 646255
Remove attempts by inference to perform lazy standard class initialization.  This is the only place where inference called back into the VM (other than for GC).  The TM bug is still there, spun off as bug 642559.

http://hg.mozilla.org/projects/jaegermonkey/rev/e786040097a3
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.