If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

TypeInference: inference failure when calling array methods on objects

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Depends on: 1 bug, Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

---
var o = {}; 
[].pop.call(o); 
var x = o.length;
---
Triggers:
[infer failure] Missing type at #1:00030 popped 0: int

The happens for at least push, pop, shift and unshift.
Good catch!  The array methods in particular need stronger write barriers to establish a correspondence between the type handler and actual behavior.  The handlers really only deal with array receiver types, while the methods themselves can handle any object.
Blocks: 619415
No longer blocks: 608741
Depends on: 619693
(Reporter)

Updated

7 years ago
Blocks: 621126
This adds write barriers for the .length properties of non-array objects updated by array natives.  This seemed to be the only thing the natives could update that was not already accounted for by the type handlers --- integral properties are represented the same way for all objects.

http://hg.mozilla.org/projects/jaegermonkey/rev/6b5c2cb89388
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.