642248 - TI: [infer failure] Object not packed array at #5:00018 popped 0: #3:10:Array:new

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test case (run with -n -a -m) crashes on TI tip (tested on 64
bit):

function test(makeNonArray) {
    function C() {}
    C.prototype = []
    c = new C();
    c.push("foo");
    return c.length
}
assertEq(test(true), 1);
var a = [];
var b = Object.create(a);
eval('var {a} = b; c(d + 1);');

Comment 1

[Brian Hackett [Laid off!]]

We had a bad design that decided whether new type objects are arrays by looking at whether the prototype is an array and trying to mark points where non-array objects can have array prototypes.  This fixes that so type objects which will always be arrays are marked as such after their creation.

http://hg.mozilla.org/projects/jaegermonkey/rev/ecae35e0821d

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug642248.js.