659779 - TI: Assertion failure: [infer failure] Missing type for #4 arg 0: #8:93:Array:new

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 8bcb569c9bf9 (run with -j -m -a -n), tested on 64 bit:


var gTestcases = new Array;
function TestCase(n, d, e, a) {
  this.description=d
  gTestcases[gTc++]=this
}
TestCase.prototype.dump=function () + toPrinted(this.description)
function toPrinted(value) value=value;
function reportCompare (expected, actual, description) {
  new TestCase("unknown-test-name", description, expected, actual)
}
function enterFunc (funcName) {
  try {
    expectCompile = 'No Error'
    var actualCompile;
    reportCompare(expectCompile, actualCompile, ': compile actual')
  } catch(ex) {}
}
gTc=0;
function jsTestDriverEnd() {
  for (var i = 0; i < gTestcases.length; i++) gTestcases[i].dump()
}
enterFunc();
reportCompare(0, 0, 5.123456);
reportCompare(0, 0, this );
jsTestDriverEnd();
try { 
  this.__proto__=[] 
} catch(ex) {}
jsTestDriverEnd()

Comment 2

[Brian Hackett [Laid off!]]

Fixed as part of rev 81997070017e, slightly bogus assert introduced recently which also showed up on tinderbox.  In DEBUG mode we now check on JIT entry points in scripts that the actual types of the arguments matches the inferred types.  This checking didn't account for type transformations in the arguments due to mutable __proto__ (used the wrong function to check for a match).

Comment 3

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929