Closed
Bug 645985
Opened 15 years ago
Closed 15 years ago
TI+JM: Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Unassigned)
References
Details
--
function f(o) {
o += "";
o.hasOwnProperty("x");
}
f({});
--
$ ./js -a -n -m test.js
Assertion failure: top->isType(JSVAL_TYPE_OBJECT), at ../methodjit/Compiler.cpp:4440
hasOwnProperty is a singleton but o's known type is string.
|
||
Comment 1•15 years ago
|
||
Yeah, the check made to see if we knew the top of the stack in CALLPROP *might* be an object was insufficient.
http://hg.mozilla.org/projects/jaegermonkey/rev/cfeb40109a60
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•