659448 - TI: Multiple [infer failure] Missing type in object #2:prototype errors

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Test case for shell (run with -j -n -a -m)

The attached testcases produce infer failures on TI revision 29f08848d96c (run with -j -m -n -a), tested on 64 bit. All tests look similar so it's likely that it's a single problem source.

Comment 1

[Christian Holler (:decoder)]

Attachment: Second test case for shell (run with -j -n -a -m)

Comment 2

[Christian Holler (:decoder)]

Attachment: Third test case for shell (run with -j -n -a -m)

Comment 4

[Brian Hackett [Laid off!]]

stubs::SetName had a path where it would assign to an object without going through a type barrier.  Missed this while grepping because it was doing setSlot instead of nativeSetSlot (like the interpreter does).  This fixes all three testcases.

http://hg.mozilla.org/projects/jaegermonkey/rev/fb3171c03055

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug659448.js.