686179 - TI: Assertion failure: [infer failure] Missing type in object [0x7f6e8b304340] arguments: null, at jsinfer.cpp:341

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Christian Holler (:decoder)]

The following test asserts on jaegermonkey branch revision b31b25125429 (options -m -n -a):


(function () {
  assertEquals = function assertEquals(expected, found, name_opt) {  };
  assertTrue = function assertTrue(value, name_opt) {  };
})();
function f0() {}
function f1(x) {}
function test(f) {
  assertTrue(null === (assertEquals).arguments);
}
test(f0);
test(f1);

Comment 1

[Brian Hackett (:bhackett)]

Overly strict assert when checking the consistency of type information with values read at property accesses in the VM.  Property types are only required to reflect the values of normal data/method properties and dense array elements, but this was asserting that properties with getter hooks also had correct type information.  There used to be code that kept the getter hook property types up to date, but this property is not guaranteed, nothing downstream depended on this and it was wasted work, so removed in the getter PIC patch.

http://hg.mozilla.org/projects/jaegermonkey/rev/820f11a3fdb1

Comment 2

[Brian Hackett (:bhackett)]

https://hg.mozilla.org/mozilla-central/rev/c943bbf9dac4

Comment 3

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929