Closed Bug 1164778 Opened 4 years ago Closed 4 years ago

super.prop inside heavyweight arrow function asserts shell.

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla41
Tracking Status
firefox41 --- fixed

People

(Reporter: efaust, Assigned: efaust)

Details

Attachments

(1 file, 1 obsolete file)

class foo {
    constructor() { } 

    method() {
        return (() => (eval(''), super.toString));
    }   
}
print(new foo().method()().toSource());

Asserts the shell with
Assertion failure: callee.isMethod(), at /home/efaust/m-classes/js/src/vm/Interpreter.cpp:3983
Attached patch Fix and test (obsolete) — Splinter Review
Attachment #8605698 - Flags: review?(shu)
Attached patch Fix and testSplinter Review
Now with 100% more patch!
Attachment #8605698 - Attachment is obsolete: true
Attachment #8605698 - Flags: review?(shu)
Attachment #8606479 - Flags: review?(shu)
Comment on attachment 8606479 [details] [diff] [review]
Fix and test

Review of attachment 8606479 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/Interpreter.cpp
@@ +3979,5 @@
>      ScopeIter si(cx, REGS.fp()->scopeChain(), REGS.fp()->script()->innermostStaticScope(REGS.pc));
>      for (; !si.done(); ++si) {
>          if (si.hasScopeObject() && si.type() == ScopeIter::Call) {
>              JSFunction& callee = si.scope().as<CallObject>().callee();
> +            

Trailing whitespace here and below.
Attachment #8606479 - Flags: review?(shu) → review+
https://hg.mozilla.org/mozilla-central/rev/8019934ef002
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in before you can comment on or make changes to this bug.