663708 - TI: "Assertion failure: [infer failure] Missing type pushed 0: int,"

Status: RESOLVED DUPLICATE of bug 663690

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

N = FOO = ll = typeof ""
d = ls = p
function p() {}
a = typeof n == ""
function ng() {}
function f2() {}
if ((e = N)) {
    es = f2
}
function un() {}
function y() {}
function f1(code) {
    de = "";
    f = f3("(function(){" + code + "})")
    var uf = uneval(f)
    var g = f3(uf);
    if (([] = g)) v = f4(f)
}
function f3(s) {
    return eval(s)
}
function f4(f) {
    try {
        var rv = f()
        return rv
    } catch (r) {
        if (verbose) {}
    }
}
E = h = Math;
n = C = l = g = ce = this
function r() {}
function ff() {}
function cg() {}
function cl() {}
function c() {}
function c3() {}
function o() {}
s = nt = verbose = o9 = r
function f0() {}
f1("")
f1("")
t = f1("")
f1("")
f1("")
f1("")
u = 2
f1("for(lerexx=0;lerexx<3;){return 0}")

asserts js debug shell on JM changeset 38f2fbc8490d with -m, -a, -j and -n at Assertion failure: [infer failure] Missing type pushed 0: int,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   71047:38f2fbc8490d
tag:         tip
user:        Brian Hackett
date:        Sat Jun 11 09:46:48 2011 -0700
summary:     [INFER] Always use type barriers at NAME opcodes, tweak USES_BEFORE_COMPILE and CONTRIBUTION_LIMIT, bug 662383.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Related to bug 663351?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Pass in testcase as a CLI argument to reproduce.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 663690).