Closed Bug 645985 Opened 9 years ago Closed 9 years ago

TI+JM: Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

--
function f(o) {
    o += "";
    o.hasOwnProperty("x");
}
f({});
--
$ ./js -a -n -m test.js
Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440

hasOwnProperty is a singleton but o's known type is string.
Yeah, the check made to see if we knew the top of the stack in CALLPROP *might* be an object was insufficient.

http://hg.mozilla.org/projects/jaegermonkey/rev/cfeb40109a60
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.