Repository navigation
JS Crash: global type reference to constructor function #32997
Description
From chrome-devtools-frontend's failure in #32991:
// @Filename: test.js
var SDK = {}
SDK.SourceMap = function () { }
SDK.SourceMap.prototype = { compiledURL() {} }
// @Filename: other.js
/**
* @param {SDK.SourceMap} sourceMap
*/
function no(sourceMap) {
return sourceMap.wat
}Expected behavior:
no crash and a bunch of errors
Actual behavior:
assert from merging a symbol into itself. it looks like both the function () {} and SDK.SourceMap lhs of assignment get the prototype method in the binder.
Activity
sandersn commentedon Aug 20, 2019
Looks like we don't cache correctly and try to merge into the same symbol twice.
sandersn commentedon Aug 20, 2019
Welp Wesley Wigham (@weswigham), looks like I found a reason I need caching in mergeJSSymbols; you'll often want to get the
typeanddeclaredTypeboth from a symbol, and both code paths call mergeJSSymbols. We want to avoid double-merging any particular symbol into the combined symbol.weswigham commentedon Aug 20, 2019
Thereeeeeeee we go. I figured there had to be a reason. XD
sandersn commentedon Aug 21, 2019
Also, bonus crash, if you leave out
compiledURLthen the cloned target doesn't get an empty map formembersand crashes in getIndexType.