Closed
Bug 765485
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: [infer failure] Missing type in object [0x7f9637700220] m: string, at jsinfer.cpp:328
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 765479
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update] js-triage-needed)
The following testcase asserts on ionmonkey revision de23a9fc29db (run with --ion -n -m --ion-eager): function testRebranding2() { var x = "FAIL"; function g(){} var obj = {m: g}; for (var i = 0; i < 5; i-- ) { obj.m = (x)[i]; obj.m(); } } assertEq(testRebranding2(), "ok");
Comment 1•12 years ago
|
||
Sounds related to: https://hg.mozilla.org/projects/ionmonkey/rev/17e811e71344
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update] js-triage-needed
Updated•12 years ago
|
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Updated•10 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•