Last Comment Bug 655711 - TI: [infer failure] Missing type at #2500:00066 pushed 0: Unique:new
: TI: [infer failure] Missing type at #2500:00066 pushed 0: Unique:new
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: 619433
  Show dependency treegraph
 
Reported: 2011-05-09 07:33 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-09 15:07 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (1.38 KB, patch)
2011-05-09 13:51 PDT, Jan de Mooij [:jandem]
bhackett1024: review+
Details | Diff | Splinter Review

Description Jan de Mooij [:jandem] 2011-05-09 07:33:25 PDT
This is causing M1, M2, Moth failures.

JSOP_THIS pushes this value:
--
object 0x21631048
class 0x2269880 Proxy
flags: delegate
proto <XPC_WN_ModsAllowed_NoCall_Proto_JSClass object at 0x1c6781c0>
parent <Window object at 0x1fd051f8>
not native
--
And the expected type is object[1] Global.

Only happens with JM enabled.
Comment 1 Jan de Mooij [:jandem] 2011-05-09 13:51:11 PDT
Created attachment 531124 [details] [diff] [review]
Patch

jsop_this would push the outer window if |this| is undefined or null, but script->getGlobalType() referred to the inner window. The fix, as discussed on IRC, is to mark the resulting type as unknown in this case. Correct me if I'm wrong.
Comment 2 Jan de Mooij [:jandem] 2011-05-09 15:07:54 PDT
http://hg.mozilla.org/projects/jaegermonkey/rev/cb9c34a8b2b4

Note You need to log in before you can comment on or make changes to this bug.