Closed
Bug 643281
Opened 15 years ago
Closed 15 years ago
TI: Crash [@ ScopeNameCompiler::updateTypes]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 643113
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
Ok, the test looks strange, but this code crashes TI tip with options "-m -a -n" (tested on 64 bit):
if (typeof window == 'undefined')
{
function test()
{
}
}
0x000000000070dfdb in ScopeNameCompiler::updateTypes (this=0x7fff9fe055b0) at ./methodjit/PolyIC.cpp:1547
1547 types = getprop.obj->getType()->getProperty(cx, shape->id, false);
(gdb) bt
#0 0x000000000070dfdb in ScopeNameCompiler::updateTypes (this=0x7fff9fe055b0) at ./methodjit/PolyIC.cpp:1547
#1 0x00000000006fc571 in js::mjit::ic::Name (f=@0x7fff9fe05670, pic=0x26b2bd0) at ./methodjit/PolyIC.cpp:2022
#2 0x00007f6677664133 in ?? ()
#3 0x00007f6677664068 in ?? ()
#4 0x00000000026b26e0 in ?? ()
#5 0x0000000000000000 in ?? ()
|
||
Updated•15 years ago
|
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
Summary: TI: Crash @ [ScopeNameCompiler::updateTypes] → TI: Crash [@ ScopeNameCompiler::updateTypes]
|
||
Updated•15 years ago
|
Crash Signature: [@ ScopeNameCompiler::updateTypes]
|
Reporter | |
Comment 2•13 years ago
|
||
A testcase for this bug was already added in the original bug (bug 643113).
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•