TI: [infer failure] Missing type in object #2:9:Array 123\x00456: int

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Trunk
x86_64
Linux
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following testcase crashes on TI revision 693a36f402ee (run with -m -n -a),
tested on 64 bit:

a = new Array;
for (var i = 0; i != 1000; ++i) a[i] = 17;
var x = '123' + '\0' + '456';
(1, a[x], ': 123\\0456');
MakeTypeId has a loop similar to js_StringIsIndex testing for strings which should be represented by the aggregate id for integer indexes.  The two behaved differently on strings containing nulls (did this change on TM recently?  I made sure there was a correspondence when writing MakeTypeId).  Would be nice to remove the duplicate code and make MakeTypeId simpler, but I'd like to have the property that all integers and strings representing integers (including negative integers) map to the same type ID.  Need to think about this some more.

http://hg.mozilla.org/projects/jaegermonkey/rev/6d27f6e4e07a
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
I think this is actually a TM bug, I filed bug 653175 a few weeks ago. Once that bug is fixed we'll get a new inference failure though, so it's not a big problem and at least we're more consistent now.
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 3

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug657247.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.