Closed Bug 647464 Opened 9 years ago Closed 9 years ago

TI: Crash [@ js::types::TypeFailure]

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

RegExp.__proto__

crashes js opt shell on JM changeset c340841f0465 with -m, -a and -n at js::types::TypeFailure with the following message:

[infer failure] Missing type at #2:00000 pushed 0: RegExp
o={x:3}.__proto__
RegExp

is a similar testcase, but has to be passed in as a CLI argument.
The new DefineConstructorAndPrototype function used to initialize the RegExp class (and only the RegExp class) wasn't updating the type properties of the global object (need to fix addProperty/setProperty/etc. so these calls to addTypeProperty aren't needed at all, bug 619693).

http://hg.mozilla.org/projects/jaegermonkey/rev/ecac9d924832
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Crash Signature: [@ js::types::TypeFailure]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.