Last Comment Bug 657986 - TI: Crash [@ js::types::TypeFailure] involving missing type in object Global i: #4:15:Array
: TI: Crash [@ js::types::TypeFailure] involving missing type in object Global ...
Status: RESOLVED FIXED
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz js-differential-test infer-regress
  Show dependency treegraph
 
Reported: 2011-05-18 11:09 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 13:57 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Gary Kwong [:gkw] [:nth10sd] 2011-05-18 11:09:42 PDT
function f(x) {
    this.i = x;
}
for each(let e in [0, 0, []]) {
    try {
        f(e)
    } catch (e) {}
}
print(uneval(this))

crashes js debug shell on JM changeset 5d1cbc94bc42 with -m, -a and -n at js::types::TypeFailure with the message:

[infer failure] Missing type in object Global i: #4:15:Array
Comment 1 Brian Hackett (:bhackett) 2011-05-18 11:15:57 PDT
WFM on tip, possibly fixed by rev 29bd8523ead9.  Can you still repro?
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-05-18 11:37:27 PDT
WFM on tip too - but marking FIXED since a possible fix changeset is noted.
Comment 3 Christian Holler (:decoder) 2013-01-19 13:57:22 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.