Closed Bug 639529 Opened 12 years ago Closed 12 years ago

TI: [infer failure] Missing type in object #2 toString: string

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: paul.biggar)

References

Details

(Whiteboard: fixed-in-jaegermonkey)

--
function f() {}
g = wrap(f);
g.__defineGetter__('toString', f.toString);
g.toString;
--
$ ./js -n test.js
[infer failure] Missing type in object #2 toString: string
This looks like a straightforward one to start with.
Assignee: general → pbiggar
Property types were being updated when properties were set through wrappers, but not when they were defined as such.

http://hg.mozilla.org/projects/jaegermonkey/rev/816e5118734b
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
In theory the choke point for this stuff should be in the shape/set machinery, not the wrapper itself.
Yeah, fixes for bug 619693 added the write barrier at all calls that set/define properties, except obj->setProperty and obj->defineProperty themselves.  Those should I think get fixed too (main issue is making sure the barrier is always called exactly once), removing most of these problematic cx->addTypeProperty calls.  Which would only leave direct sets of object slots and dense array elements as needing extra write barrier calls.
You need to log in before you can comment on or make changes to this bug.