Last Comment Bug 652142 - TI+JM: [infer failure] Missing type in object TableObject:1 a: float
: TI+JM: [infer failure] Missing type in object TableObject:1 a: float
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-04-22 09:24 PDT by Jan de Mooij [:jandem]
Modified: 2011-04-23 22:53 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] 2011-04-22 09:24:41 PDT
--
var x = {};
var y = {a: 2};
{
    function f() {}
}
y.a = (z = x).b = 6.3;
y.a--;
--
$ ./js -n -a -m -d test.js
[infer failure] Missing type in object TableObject:1 a: float

Revision 90a7b141e0cf, 32-bit OS X.
Comment 1 Brian Hackett (:bhackett) 2011-04-23 22:53:36 PDT
The SSA patch had a sort of broken fix for a situation that comes up in debug-mode compartments and showed up using jitflags=na.  With EvaluateInStackFrame, new bindings can be introduced that cause GNAME ops to suddenly refer to local variables, as with a NAME op.  The SSA patch addressed this by treating all property accesses as unknown in debug compartments, which broke these assertions for type object consistency as the type objects themselves weren't getting marked as unknown.

This changes the fix to be more narrowly focused, and just mark the results of GNAME ops as unknown in debug compartments.

http://hg.mozilla.org/projects/jaegermonkey/rev/a16bbfe4f0f4

Note You need to log in before you can comment on or make changes to this bug.