558616 - JM: "Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../methodjit/Stubs.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  for each(let d in [{}, {}, 0]) {
    for each(e in [0, 0, 0, 0, 0, 0, 0, 0, 0]) {
      d.__defineSetter__("", function() {})
    }
  }
})()

asserts js debug shell on JM tip with -m at Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../methodjit/Stubs.cpp:2984

Comment 1

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/47d3d2127057

Cause: updatePICGetProp is used for both getprop and callprop, because they do pretty much the same thing. There was leftover code from when it was for getprop only that patched to jsl_GetProp if the PIC got too big. It is now generalized to handle either case.

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/pic/bug558616.js.