617750 - TypeInference: Missing type at #1:00033 popped 0: RegExp:prototype:new

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

---
x = [].concat(/abc/).shift();
assertEq(x.source, "abc");
---
./js:
[infer failure] Missing type at #1:00023 popped 0: RegExp:prototype:new
Bus error

./js -m:
test.js:2: TypeError: x is undefined

Comment 1

[Brian Hackett [Laid off!]]

These '[infer failure]' reports are bugs in the inference itself, and show up best when the interpreter is running (every value popped by a bytecode is checked against the inferred information for that stack slot, along with other checks for array denseness/packedness).  This shows up in this example because [].concat produces bytecode which the mjit doesn't compile and we fallback to the interpreter.  It might be good to also fuzz interpreter-only to test the inference more thoroughly.

Comment 2

[Brian Hackett [Laid off!]]

The type modeling the behavior of Array.concat did not handle non-array arguments.

http://hg.mozilla.org/projects/jaegermonkey/rev/e074599afab9

Comment 3

[Brian Hackett [Laid off!]]

Er, type *handler*