663351 - TI: Assertion failure: [infer failure] Missing type pushed 0: int, at jsinfer.cpp:289

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
var x = [];
x.join = function () { 
    return 5;
};
assertEq(x.toString(), 5);
--
$ ./js -n -a test.js
Missing type at #3:00040 pushed 0: int
Assertion failure: [infer failure] Missing type pushed 0: int, at jsinfer.cpp:289

Array.prototype.toString basically just calls this.join (or the builtin Object.prototype.toString if join is not callable)

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Call MarkTypeCallerUnexpected when array_tostring returns a non-string value. toLocaleString and join call array_toString_sub which always returns a string and does not have this problem.

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 538486 [details] [diff] [review]
Patch

These bugs need to get killed at their source.  Filed bug 663381.

Comment 3

[Brian Hackett [Laid off!]]

This (and other problems with natives returning things unaccounted for) was fixed by bug 663381.