Closed Bug 487534 Opened 14 years ago Closed 14 years ago

TM: "Assertion failure: JSVAL_IS_NULL(v)" with function/regexp used as index

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: Waldo)

Details

(Keywords: assertion, fixed1.9.1, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

var fs = { x: /a/, y: /a/, z: /a/ };
for (var p in fs) { this[fs[p]] = null; }

Assertion failure: JSVAL_IS_NULL(v), at ../jstracer.cpp:5178


var fs = { x:function(){}, y:function(){}, z:function(){} };
for (var p in fs) { this[fs[p]] = null; }

Assertion failure: JSVAL_IS_NULL(v), at ../jstracer.cpp:5178
Didn't we fix this once before already?  Sigh...
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
And I reviewed bug 484120!  No soup for me!
Attachment #371766 - Flags: review?(graydon)
Comment on attachment 371766 [details] [diff] [review]
The other half of the problem

I don't really know the semantics of SETELEM, but it looks as though it can't hurt to make the recording criterion tighter! Go for it.
Attachment #371766 - Flags: review?(graydon) → review+
http://hg.mozilla.org/tracemonkey/rev/58d1a7bdad9a

This morphs val[obj] = ... into val["null"] = ... so nothing scary but still a basic correctness bug.
Flags: blocking1.9.1?
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/58d1a7bdad9a
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Flags: blocking1.9.1? → blocking1.9.1+
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.