Closed
Bug 685313
Opened 14 years ago
Closed 14 years ago
Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:341
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: fixed-in-jaegermonkey)
The following test asserts on mozilla-central revision b7d269a291b6 (options -m -n -a):
function testBug501690() {
function D(){}
arr = [
new (function D ( ) {
D += '' + testBug501690;
}),
new D
];
}
testBug501690();
|
||
Comment 1•14 years ago
|
||
Analysis bug from the recent closure perf stuff. When resolving NAME accesses to the closure they will target, we didn't account for the function names which will appear in DeclEnv objects for named lambda functions, causing the name to resolve wrong.
http://hg.mozilla.org/projects/jaegermonkey/rev/353b160fb804
Whiteboard: js-triage-needed → fixed-in-jaegermonkey
|
|
||
Comment 2•14 years ago
|
||
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
Reporter | |
Comment 3•13 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug685313.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•