Last Comment Bug 657586 - TI: Crash [@ js::types::TypeFailure] involving missing type in object #3:26:Object set: #2
: TI: Crash [@ js::types::TypeFailure] involving missing type in object #3:26:O...
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress 619693 630996
  Show dependency treegraph
 
Reported: 2011-05-17 05:04 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 14:10 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Gary Kwong [:gkw] [:nth10sd] 2011-05-17 05:04:47 PDT
(function() {
    with([]) {}
    Object.defineProperty([], "", {
        set: (function() {})
    })
})()

crashes js debug shell on JM changeset 8aa5d9272628 with -m and -n at js::types::TypeFailure

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   69785:f18e992f6ec8
user:        Brian Hackett
date:        Mon May 16 16:15:37 2011 -0700
summary:     [INFER] Move addTypeProperty barriers under obj->setProperty, obj->defineProperty, bug 619693.
Comment 1 Brian Hackett (:bhackett) 2011-05-17 06:40:45 PDT
When defining native properties we weren't updating the type information for properties with a method barrier.  Weird this didn't show up in jit-tests or jstests, but it looks like it did on tinderbox.

http://hg.mozilla.org/projects/jaegermonkey/rev/97f9e3274bd5
Comment 2 Christian Holler (:decoder) 2013-01-19 14:10:05 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.