649771 - TI: [infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f(o) {
    f = o.constructor;
    eval('delete o.x');
}
for(var i=0; i<3; i++) {
    f(RegExp.prototype);
}
--
$ ./js -n -a test.js
[infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype

Revision a3eeee8f7803.

Comment 1

[Brian Hackett [Laid off!]]

The RegExp constructor has a path where it returns its own argument, but the type handler only accounted for the case where this was the default 'new' RegExp for the associated global and not another regexp like RegExp.prototype.

http://hg.mozilla.org/projects/jaegermonkey/rev/15c08e891011