Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:341

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision b7d269a291b6 (options -m -n -a):


function testBug501690() {
    function D(){}
    arr = [
        new (function D   (  ) { 
                D += '' + testBug501690; 
        }), 
        new D
    ];
}
testBug501690();
Analysis bug from the recent closure perf stuff.  When resolving NAME accesses to the closure they will target, we didn't account for the function names which will appear in DeclEnv objects for named lambda functions, causing the name to resolve wrong.

http://hg.mozilla.org/projects/jaegermonkey/rev/353b160fb804
Whiteboard: js-triage-needed → fixed-in-jaegermonkey
https://hg.mozilla.org/mozilla-central/rev/c02868b913d5
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 3

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug685313.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.