487534 - TM: "Assertion failure: JSVAL_IS_NULL(v)" with function/regexp used as index

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

var fs = { x: /a/, y: /a/, z: /a/ };
for (var p in fs) { this[fs[p]] = null; }

Assertion failure: JSVAL_IS_NULL(v), at ../jstracer.cpp:5178


var fs = { x:function(){}, y:function(){}, z:function(){} };
for (var p in fs) { this[fs[p]] = null; }

Assertion failure: JSVAL_IS_NULL(v), at ../jstracer.cpp:5178

Comment 1

[Jeff Walden [:Waldo]]

Didn't we fix this once before already?  Sigh...

Comment 2

[Jeff Walden [:Waldo]]

Attachment: The other half of the problem

And I reviewed bug 484120!  No soup for me!

Comment 3

[Graydon Hoare :graydon]

Comment on attachment 371766 [details] [diff] [review]
The other half of the problem

I don't really know the semantics of SETELEM, but it looks as though it can't hurt to make the recording criterion tighter! Go for it.

Comment 4

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/58d1a7bdad9a

This morphs val[obj] = ... into val["null"] = ... so nothing scary but still a basic correctness bug.

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/58d1a7bdad9a

Comment 6

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/39ad6584cbab

Comment 7

[Michael Kraft [:morac]]

Either bug 487271, bug 487534 or bug 487271 caused bug 488843.

Comment 8

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929