Last Comment Bug 659439 - TI+JM: [infer failure] Missing type in object #6:22:Object x: BoundFunction
: TI+JM: [infer failure] Missing type in object #6:22:Object x: BoundFunction
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-05-24 14:06 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-24 14:44 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] 2011-05-24 14:06:05 PDT
--
function bind(f) {
    return f.call.apply(f.bind, arguments);
};
function h(a, b) {
    a.x;
}
function g(a, b) {
    a.x = b;
    h(a);
}
function f() {
    for(var i=0; i<20; i++) {
        g.call(this, {}, bind(function(){}));
    }
}
f();
--
$ ./js -m -n -a test.js
[infer failure] Missing type in object #6:22:Object x: BoundFunction
Comment 1 Brian Hackett (:bhackett) 2011-05-24 14:44:03 PDT
Lowered Function.call could go through the fast entry point of its callee (bypassing argument type checks).  Fix marks all FUNCALL and FUNAPPLY sites as monitored.  This is a recent regression, these natives used to be cluttered with special type handlers marking the site as monitored (in changing this, I somehow thought lowered FUNCALL always went through the arity check in the same way as lowered FUNAPPLY).

http://hg.mozilla.org/projects/jaegermonkey/rev/3b0ae9af7194

Note You need to log in before you can comment on or make changes to this bug.