642307 - TI: [infer failure] Missing type at #5:00018 pushed 0: int

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: shell testcase, unpack, chdir and run main.js with options "-n -a"

The attached test case (unpack, chdir and run main.js with -n -m) crashes on
TI tip (tested on 64 bit). I wasn't able to condense this into a single file so far.

Comment 1

[Brian Hackett [Laid off!]]

Cool test case!  To help some with -a, inference will try to resolve standard classes as it sees them.  This requires that such resolving does not reenter the interpreter (something we should assert).  This test case prevents extensions on the global object so the resolving throws (which is in itself a TM bug, filed as bug 642559), and also makes a toSource on the global so that constructing the exception reenters the interpreter.

Comment 6

[Brian Hackett [Laid off!]]

Remove attempts by inference to perform lazy standard class initialization.  This is the only place where inference called back into the VM (other than for GC).  The TM bug is still there, spun off as bug 642559.

http://hg.mozilla.org/projects/jaegermonkey/rev/e786040097a3