572229 - tracing+fatvals: Assert when using 'in' with a dependent string

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

This asserts with fatvals and -j only:

function f(o, s) {
    var k = s.substr(0, 1);
    var c;
    for (var i = 0; i < 10; ++i) {
	c = k in o;
    }
}

f({ a: 66 }, 'abc');

Comment 1

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/users/lwagner_mozilla.com/fatval/rev/f92919e945ae