660204 - TI: Assertion failure: [infer failure] Missing type at #2:00014 pushed 0: Global

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 1252c464553e (run with -j -m -a -n), tested on 64 bit:


eval("try { name(); } catch(e) {}");
function Employee ( name, dept ) {
  this.name=name || ""
  this.dept
}
function WorkerBee ( name, dept, projs ) {
  this.base=Employee
  this.base( name, dept)
}
new WorkerBee;
WorkerBee();

Comment 1

[Brian Hackett [Laid off!]]

Bug in how propagation of 'this' to callees at a CALLPROP interacts with type barriers at said CALLPROP.  If the 'this' propagation could not figure out the possible callees, it assumed the call would be monitored anyways and didn't bother to compute a correct result.  If barriers at the call site meant we knew the possible callees by the time we got to the call site, however, we wouldn't monitor the call.  This fixes things by making sure that if the 'this' propagation is incomplete at a CALLPROP the call is definitely monitored.  (This is kind of a sledgehammer solution though, may rework this to do better at such call sites).

http://hg.mozilla.org/projects/jaegermonkey/rev/772f0b507d01

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug660204.js.