Closed
Bug 647464
Opened 15 years ago
Closed 14 years ago
TI: Crash [@ js::types::TypeFailure]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
RegExp.__proto__
crashes js opt shell on JM changeset c340841f0465 with -m, -a and -n at js::types::TypeFailure with the following message:
[infer failure] Missing type at #2:00000 pushed 0: RegExp
|
Reporter | |
Comment 1•14 years ago
|
||
o={x:3}.__proto__
RegExp
is a similar testcase, but has to be passed in as a CLI argument.
|
||
Comment 2•14 years ago
|
||
The new DefineConstructorAndPrototype function used to initialize the RegExp class (and only the RegExp class) wasn't updating the type properties of the global object (need to fix addProperty/setProperty/etc. so these calls to addTypeProperty aren't needed at all, bug 619693).
http://hg.mozilla.org/projects/jaegermonkey/rev/ecac9d924832
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Updated•14 years ago
|
Crash Signature: [@ js::types::TypeFailure]
|
||
Comment 3•13 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•