700471 - [ObjShrink] Crash at unknown address or "Assertion failure: [infer failure] Missing type for arg 0: void,"

Status: RESOLVED DUPLICATE of bug 700501

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

gc()
Function("\
  {\
  function f(b){b.q}\
  for each(let c in[/x/,[],/x/,[].e]){\
    f(c)\
  }\
  }\
")()

asserts js debug shell on JM changeset 1210706b4576 with -m, -a and -n at Assertion failure: [infer failure] Missing type for arg 0: void, and crashes js opt shell at an unknown address:

Program received signal SIGSEGV, Segmentation fault.
0xf73f2275 in ?? ()
(gdb) bt
#0  0xf73f2275 in ?? ()
#1  0xf740abe0 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/i $pc
=> 0xf73f2275:	mov    (%edi),%ebx
(gdb) x/b $edi
0x0:	Cannot access memory at address 0x0
(gdb) x/b $ebx
0xf740ace0:	0xe8

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 700501).