Closed Bug 645985 Opened 13 years ago Closed 13 years ago

TI+JM: Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

Details

--
function f(o) {
    o += "";
    o.hasOwnProperty("x");
}
f({});
--
$ ./js -a -n -m test.js
Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440

hasOwnProperty is a singleton but o's known type is string.
Yeah, the check made to see if we knew the top of the stack in CALLPROP *might* be an object was insufficient.

http://hg.mozilla.org/projects/jaegermonkey/rev/cfeb40109a60
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.