648567 - TI+JM: incorrect result with array testcase

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Testcase

$ ./js -a -n -m test.js
test.js:8: Error: Assertion failed: got 1e-323, expected 2

The test does not fail if the first element in the array is >= 0, it will use JSOP_OBJECT instead of JSOP_INITARRAY.

Comment 1

[Brian Hackett [Laid off!]]

When inlining a call, we don't write types for the inlined call's local variables when they are known statically.  For uninlined calls, we do make such writes (we probably shouldn't be doing this, just remember known types on the JITScript and fill in before recompiling).  When expanding inline frames, these unsynced type tags always need to be written.

The reason this works if the initializer is a JSOP_OBJECT is that we use the default, unknown type object for singleton arrays with heterogenous element type, so did not assume anything at all about the array or its contents and didn't incur the recompilations triggering this bug.

http://hg.mozilla.org/projects/jaegermonkey/rev/ef890e014ce1