660537 - TI: Crash [@ js::types::TypeFailure] involving missing type at #54:00034 pushed 0: #54:20:Array

Status: RESOLVED DUPLICATE of bug 657193

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(code) {
    g = eval("(function(){" + code + "})");
    g()
}
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f("<x/>.(x=[]);function x(){}(x())");

crashes js debug shell on JM changeset 56eeb8e6d7c2 with -m and -n at js::types::TypeFailure and shows the following messages:

[infer failure] Missing type at #54:00034 pushed 0: #54:20:Array