Closed Bug 643245 Opened 13 years ago Closed 13 years ago

TI: Crash [@ js::types::TypeFailure] with missing type pushed inference failure

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 643244

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

(function () {
    delete({
        x: (function() {
            return Boolean(false).__proto__
        })()
    }).x.valueOf
})()
for (e in (eval("(function(){yield true.valueOf()})"))()){}

crashes js debug shell on JM changeset 5ce2f7a90286 with -m, -a and -n
at js::types::TypeFailure and a message [infer failure] Missing type at #6:00005 pushed 0: Boolean:prototype:new

This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ js::types::TypeFailure]
A testcase for this bug was already added in the original bug (bug 643244).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.