684281 - Assertion failure: [infer failure] Missing type in object [0x7fc592604680] (index): int, at jsinfer.cpp:341

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision fcca99426576 (run with -m -n -a), tested on 64 bit:


function printStatus (msg) {}
F = function () {};
F.prototype = new Int32Array(1);
o = new F();
function f2(o){ 
	with(this) 
	for(var x in o) 
	printStatus(o[x]); 
}
f2([]);

Comment 1

[Christian Holler (:decoder)]

One more question to this test: I remember that at some point, infer failures were critical, as in, we cannot continue, therefore we abort (either through assertion or controlled crash, which we changed a while ago). This test doesn't do anything for optimized builds, is that intended behavior?

Comment 2

[Brian Hackett [Laid off!]]

The [infer failure] generally reflects that the core TI invariant, that the known types reflect the state of the world, is violated.  It does not mean we will crash later, but if we *do* crash it will probably be hard to track down the underlying cause.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Bogus assert.  Property type sets are not correct for objects with a class getter op, but we would still assert correctness for accesses on native objects which inherit properties from such objects.

Most of this patch is fixing Diassemble so that it can be called while iterating over scripts (and which I noticed while investigating this).  This broke after the recent CellIter changes in the GC (though I think that CellIter was correct to break this, as Disassemble shouldn't be allocating GC things while traversing arenas).

Comment 5

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/projects/jaegermonkey/rev/53e25966f155

Comment 6

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/mozilla-central/rev/53e25966f155

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 558013 [details] [diff] [review]
patch

I guess this landed already.

It would be nice if there were a better way to do this, but I can't think of any.

Comment 8

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929