619333 - TypeInference: inference failure when calling array methods on objects

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

---
var o = {}; 
[].pop.call(o); 
var x = o.length;
---
Triggers:
[infer failure] Missing type at #1:00030 popped 0: int

The happens for at least push, pop, shift and unshift.

Comment 1

[Brian Hackett [Laid off!]]

Good catch!  The array methods in particular need stronger write barriers to establish a correspondence between the type handler and actual behavior.  The handlers really only deal with array receiver types, while the methods themselves can handle any object.

Comment 2

[Brian Hackett [Laid off!]]

This adds write barriers for the .length properties of non-array objects updated by array natives.  This seemed to be the only thing the natives could update that was not already accounted for by the type handlers --- integral properties are represented the same way for all objects.

http://hg.mozilla.org/projects/jaegermonkey/rev/6b5c2cb89388