673469 - TI: "Assertion failure: [infer failure] Missing type in object <0x2d0d040>:new (index): #5:3,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var a = Boolean();
false.__proto__;
var c = ({}).__proto__;
var d = {};
gc()
c[0] = d;
for (var x in a) {
  a[x];
}

asserts js debug shell on JM changeset 85b77c0781b6 with -a and -n at Assertion failure: [infer failure] Missing type in object <0x2d0d040>:new (index): #5:3,

Comment 1

[Brian Hackett [Laid off!]]

We used to generate type constraints propagating types from prototypes into their instance objects, and keep these across GCs.  Bug 669969 removed this, and as a consequence requires these constraints to be regenerated as needed after each GC (only for properties which analyzed scripts are accessing, though).  The bit which indicates this propagation has been performed wasn't being reset on GC, so this didn't actually happen.

http://hg.mozilla.org/projects/jaegermonkey/rev/4fbb36c1c9a3

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug673469.js.