Last Comment Bug 649771 - TI: [infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype
: TI: [infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-04-13 13:10 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2011-04-13 15:20 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] (PTO until July 31) 2011-04-13 13:10:32 PDT
--
function f(o) {
    f = o.constructor;
    eval('delete o.x');
}
for(var i=0; i<3; i++) {
    f(RegExp.prototype);
}
--
$ ./js -n -a test.js
[infer failure] Missing type at #3:00024 pushed 0: RegExp:prototype

Revision a3eeee8f7803.
Comment 1 Brian Hackett (:bhackett) 2011-04-13 15:20:14 PDT
The RegExp constructor has a path where it returns its own argument, but the type handler only accounted for the case where this was the default 'new' RegExp for the associated global and not another regexp like RegExp.prototype.

http://hg.mozilla.org/projects/jaegermonkey/rev/15c08e891011

Note You need to log in before you can comment on or make changes to this bug.