Closed Bug 660204 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: [infer failure] Missing type at #2:00014 pushed 0: Global

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

The following testcase asserts on TI revision 1252c464553e (run with -j -m -a -n), tested on 64 bit:


eval("try { name(); } catch(e) {}");
function Employee ( name, dept ) {
  this.name=name || ""
  this.dept
}
function WorkerBee ( name, dept, projs ) {
  this.base=Employee
  this.base( name, dept)
}
new WorkerBee;
WorkerBee();
Bug in how propagation of 'this' to callees at a CALLPROP interacts with type barriers at said CALLPROP.  If the 'this' propagation could not figure out the possible callees, it assumed the call would be monitored anyways and didn't bother to compute a correct result.  If barriers at the call site meant we knew the possible callees by the time we got to the call site, however, we wouldn't monitor the call.  This fixes things by making sure that if the 'this' propagation is incomplete at a CALLPROP the call is definitely monitored.  (This is kind of a sledgehammer solution though, may rework this to do better at such call sites).

http://hg.mozilla.org/projects/jaegermonkey/rev/772f0b507d01
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug660204.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.