Closed
Bug 647464
Opened 9 years ago
Closed 9 years ago
TI: Crash [@ js::types::TypeFailure]
Categories
(Core :: JavaScript Engine, defect, critical)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash, testcase)
Crash Data
RegExp.__proto__ crashes js opt shell on JM changeset c340841f0465 with -m, -a and -n at js::types::TypeFailure with the following message: [infer failure] Missing type at #2:00000 pushed 0: RegExp
|
Reporter | |
Comment 1•9 years ago
|
||
o={x:3}.__proto__
RegExp
is a similar testcase, but has to be passed in as a CLI argument.
|
||
Comment 2•9 years ago
|
||
The new DefineConstructorAndPrototype function used to initialize the RegExp class (and only the RegExp class) wasn't updating the type properties of the global object (need to fix addProperty/setProperty/etc. so these calls to addTypeProperty aren't needed at all, bug 619693). http://hg.mozilla.org/projects/jaegermonkey/rev/ecac9d924832
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
|
||
Updated•9 years ago
|
Crash Signature: [@ js::types::TypeFailure]
|
||
Comment 3•7 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•