660597 - TI: Assertion failure: !JSID_IS_VOID(id), at jsscope.cpp:807

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 68620d37fb23 (run with -j -m -n -a), tested on 64 bit:


function foo() {
  with(foo) this["00"]=function(){}
}
new foo;

Comment 1

[Brian Hackett [Laid off!]]

Since type inference aggregates all integer properties into a single type set with the JSID_VOID id, we can't express information about whether a type object definitely has a particular integer property (not interested in this, either).  When analyzing definite properties from calling 'new' on a script, we would try to detect integer properties being added to the object and bail out from the analysis.  We did this detection incorrectly (tested 'id == MakeTypeId(id)' when id was already the result of calling MakeTypeId), so that these properties would never be filtered out.

http://hg.mozilla.org/projects/jaegermonkey/rev/d6857a2609d5

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug660597.js.