Closed
Bug 657986
Opened 14 years ago
Closed 14 years ago
TI: Crash [@ js::types::TypeFailure] involving missing type in object Global i: #4:15:Array
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
function f(x) {
this.i = x;
}
for each(let e in [0, 0, []]) {
try {
f(e)
} catch (e) {}
}
print(uneval(this))
crashes js debug shell on JM changeset 5d1cbc94bc42 with -m, -a and -n at js::types::TypeFailure with the message:
[infer failure] Missing type in object Global i: #4:15:Array
|
||
Comment 1•14 years ago
|
||
WFM on tip, possibly fixed by rev 29bd8523ead9. Can you still repro?
|
Reporter | |
Comment 2•14 years ago
|
||
WFM on tip too - but marking FIXED since a possible fix changeset is noted.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Updated•14 years ago
|
Crash Signature: [@ js::types::TypeFailure]
|
||
Comment 3•13 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•