721939 - "Assertion failure: vp[1].isObject(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = Function.prototype.__proto__
a[3] = a
x = 7;
for each(d in []) {
  d.__noSuchMethod__ = Object.isSealed
}
Function("x.f()")()


asserts js debug shell on m-c changeset 8a59519e137e with -m and -a at Assertion failure: vp[1].isObject(),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   84323:16f0d80b3137
user:        Brian Hackett
date:        Wed Jan 11 17:31:41 2012 -0800
summary:     Account for all special CALLPROP behavior in inline cache stub, bug 717208. r=dvander

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

__noSuchMethod__ seems to have the property that it shouldn't be called if the lvalue in the property access is not an object, but the way the property cache invokes GetPropertyOperation allowed __noSuchMethod__ to be called on primitives.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e62254ca31f8

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/e62254ca31f8