The default bug view has changed. See this FAQ.

TI: [infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
--
function f(o) {
    f = o.constructor;
    eval('delete o.x');
}
for(var i=0; i<3; i++) {
    f(RegExp.prototype);
}
--
$ ./js -n -a test.js
[infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype

Revision a3eeee8f7803.
The RegExp constructor has a path where it returns its own argument, but the type handler only accounted for the case where this was the default 'new' RegExp for the associated global and not another regexp like RegExp.prototype.

http://hg.mozilla.org/projects/jaegermonkey/rev/15c08e891011
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.