Closed Bug 557464 Opened 12 years ago Closed 12 years ago

JM: "Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../methodjit/Stubs.cpp"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: dmandelin)

References

Details

(Keywords: assertion, regression, testcase)

for each(let w in [[], 0, [], 0]) {
  w.unwatch()
}

asserts js debug shell with -m on JM tip at Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../methodjit/Stubs.cpp:3012
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/3fdfbb331675

When disabling the stub, I was still always using the GetProp basic stub instead of the CallProp or GetProp as needed.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Assignee: general → dmandelin
You need to log in before you can comment on or make changes to this bug.