Closed
Bug 719758
Opened 14 years ago
Closed 14 years ago
Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:352
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
mozilla12
| Tracking | Status | |
|---|---|---|
| firefox11 | --- | unaffected |
| firefox12 | --- | fixed |
| firefox-esr10 | --- | unaffected |
People
(Reporter: decoder, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: js-triage-needed)
Attachments
(1 file)
|
4.14 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following test asserts on mozilla-central revision e5e66f40c35b (options -n -m -a):
function test() {
try {
for (var i = 0 in this) throw p;
} catch (e) {
if (i !== 94)
return "expected count2 === 94, got " + count2;
}
}
test();
S-s due to infer failure.
|
Assignee | |
Comment 1•14 years ago
|
||
Regression from bug 704387, SSA was not accounting for values at exception targets which could only be realized from an explicit 'throw' within the exception block.
Assignee: general → bhackett1024
Attachment #590267 -
Flags: review?(dvander)
|
||
Updated•14 years ago
|
Attachment #590267 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 2•14 years ago
|
||
|
||
Comment 3•14 years ago
|
||
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
|
Reporter | |
Updated•13 years ago
|
Status: RESOLVED → VERIFIED
|
||
Updated•13 years ago
|
status-firefox-esr10:
--- → unaffected
|
||
Updated•13 years ago
|
Blocks: 704387
Group: core-security
status-firefox11:
--- → unaffected
status-firefox12:
--- → fixed
Keywords: regression
|
|
Reporter | |
Comment 4•13 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug719758.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•