670637 - TI+JM: different output with testcase with -m -n

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f(x) {
    if (x.length === undefined)
        return;
    return x.map(f);
}
f([1, 2]);
--
$ ./js -m -n test.js
test.js:4: TypeError: x.map is not a function

Also interesting that we're compiling |f| if it's called by map.

Comment 1

[Brian Hackett [Laid off!]]

WFM on tip, fixed by rev b769a2b79e6b.  The problem is in JSOP_LENGTH on an object-or-something-else we would mark the result as an int32 even if the op has pushed non-integers in the past (in this case, undefined).  Now we only run the JSOP_LENGTH ops when the op is known to produce an int32.

Now that inference runs on the script's SSA form there is no reason the compiler should have better information than the inferred types.  Should add consistency assertions to catch this easier.