722656 - IonMonkey: Assertion failure: entry->prop == shape, at js/src/jsinterp.cpp:1275

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

The testcase below is reduced from tests/basic/splice-check-steps.js

$ ./js --ion -n test.js
Assertion failure: entry->prop == shape, at js/src/jsinterp.cpp:1275

Looks like there's a problem with the two NAME ops in the "note" function.
--
function f(obj) {
    var order = [];
    function note() {
        order;
        obj;
    }
    return Proxy.create({get: note});
}
proxy = f({});
for (var i=0; i<90; i++)
    proxy.foo;
proxy = f({});
for (var i=0; i<90; i++)
    proxy.foo;

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/4e487dfde168