As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact
Last Comment Bug 655711 - TI: [infer failure] Missing type at #2500:00066 pushed 0: Unique:new
: TI: [infer failure] Missing type at #2500:00066 pushed 0: Unique:new
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 619433
  Show dependency treegraph
Reported: 2011-05-09 07:33 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-09 15:07 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (1.38 KB, patch)
2011-05-09 13:51 PDT, Jan de Mooij [:jandem]
bhackett1024: review+
Details | Diff | Splinter Review

Description User image Jan de Mooij [:jandem] 2011-05-09 07:33:25 PDT
This is causing M1, M2, Moth failures.

JSOP_THIS pushes this value:
object 0x21631048
class 0x2269880 Proxy
flags: delegate
proto <XPC_WN_ModsAllowed_NoCall_Proto_JSClass object at 0x1c6781c0>
parent <Window object at 0x1fd051f8>
not native
And the expected type is object[1] Global.

Only happens with JM enabled.
Comment 1 User image Jan de Mooij [:jandem] 2011-05-09 13:51:11 PDT
Created attachment 531124 [details] [diff] [review]

jsop_this would push the outer window if |this| is undefined or null, but script->getGlobalType() referred to the inner window. The fix, as discussed on IRC, is to mark the resulting type as unknown in this case. Correct me if I'm wrong.
Comment 2 User image Jan de Mooij [:jandem] 2011-05-09 15:07:54 PDT

Note You need to log in before you can comment on or make changes to this bug.