TI+JM: Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

7 years ago
--
function f(o) {
    o += "";
    o.hasOwnProperty("x");
}
f({});
--
$ ./js -a -n -m test.js
Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440

hasOwnProperty is a singleton but o's known type is string.
Yeah, the check made to see if we knew the top of the stack in CALLPROP *might* be an object was insufficient.

http://hg.mozilla.org/projects/jaegermonkey/rev/cfeb40109a60
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.