673798 - TI: Assertion failure: v.isNumber() || v.isBoolean(), at jsobj.cpp:6540

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 9b9fd467eb5f (run with -j -m -n), tested on 64 bit:


function check() {
    check.__proto__ = null;
    return arguments.callee.caller;
}
var obj = {
    f: function () {
        check(callee = "'123123'.match(new RegExp('(123){1,}'))");
    }
};
var obj2 = {
    __proto__: obj
};
obj2.f();

Comment 1

[Brian Hackett [Laid off!]]

Different proximate cause, but fixed by rev 3ccf93107941.  When analyzing uses of 'arguments' in a script to check if they escape, we would bail out if the function's type had previously been marked unknown, and not set the script->createdArgs flag as required by the interpreter.