Closed Bug 558616 Opened 12 years ago Closed 12 years ago

JM: "Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../methodjit/Stubs.cpp"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: dmandelin)

References

Details

(Keywords: assertion, regression, testcase)

(function() {
  for each(let d in [{}, {}, 0]) {
    for each(e in [0, 0, 0, 0, 0, 0, 0, 0, 0]) {
      d.__defineSetter__("", function() {})
    }
  }
})()

asserts js debug shell on JM tip with -m at Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../methodjit/Stubs.cpp:2984
Assignee: general → dmandelin
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/47d3d2127057

Cause: updatePICGetProp is used for both getprop and callprop, because they do pretty much the same thing. There was leftover code from when it was for getprop only that patched to jsl_GetProp if the PIC got too big. It is now generalized to handle either case.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/pic/bug558616.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.