Closed Bug 461590 Opened 16 years ago Closed 16 years ago

TM: Revenge of "Assertion failure: JSVAL_TAG(v) == JSVAL_STRING"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 458851

People

(Reporter: jruderman, Unassigned)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

stack trace
1.18 KB, text/plain
Details 
[].__proto__.u = void 0;
for (let y in [5,6,7,8]) y = true;

Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1343

Only happens with JIT on.  Similar to bug 459630, which is WFM.
Attached file stack trace — 

    
    

    
  
Any for-in that reassigns the loop variable to a non-string[1] value is a dup of bug 458851.

/be

[1] if the for-in is using the standard enumerator; if a custom iterator, then non-<whatever-type-the-.next-method-returns> value.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE

    
    

    
  
A testcase for this bug was already added in the original bug (bug 458851).
Flags: in-testsuite-

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: