TI: [infer failure] Missing type in object #2 toString: string

RESOLVED FIXED

Status

()

RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jandem, Assigned: paul.biggar)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

(Reporter)

Description

8 years ago
--
function f() {}
g = wrap(f);
g.__defineGetter__('toString', f.toString);
g.toString;
--
$ ./js -n test.js
[infer failure] Missing type in object #2 toString: string
(Assignee)

Comment 1

8 years ago
This looks like a straightforward one to start with.
Assignee: general → pbiggar
Property types were being updated when properties were set through wrappers, but not when they were defined as such.

http://hg.mozilla.org/projects/jaegermonkey/rev/816e5118734b
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
In theory the choke point for this stuff should be in the shape/set machinery, not the wrapper itself.
Yeah, fixes for bug 619693 added the write barrier at all calls that set/define properties, except obj->setProperty and obj->defineProperty themselves.  Those should I think get fixed too (main issue is making sure the barrier is always called exactly once), removing most of these problematic cx->addTypeProperty calls.  Which would only leave direct sets of object slots and dense array elements as needing extra write barrier calls.
You need to log in before you can comment on or make changes to this bug.