Closed
Bug 643245
Opened 14 years ago
Closed 14 years ago
TI: Crash [@ js::types::TypeFailure] with missing type pushed inference failure
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 643244
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
(function () {
delete({
x: (function() {
return Boolean(false).__proto__
})()
}).x.valueOf
})()
for (e in (eval("(function(){yield true.valueOf()})"))()){}
crashes js debug shell on JM changeset 5ce2f7a90286 with -m, -a and -n
at js::types::TypeFailure and a message [infer failure] Missing type at #6:00005 pushed 0: Boolean:prototype:new
This was found using a combination of jsfunfuzz and jandem's method fuzzer.
|
||
Updated•14 years ago
|
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
|
||
Updated•14 years ago
|
Crash Signature: [@ js::types::TypeFailure]
|
||
Comment 2•12 years ago
|
||
A testcase for this bug was already added in the original bug (bug 643244).
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•