728187 - IonMonkey: Crash after GETPROP VM call

Status: RESOLVED DUPLICATE of bug 725357

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f(x) {
    if (x.indexOf()) {};
}
f("foo");
f(10);
--
Crashes with --ion-eager -n, I think because js::GetProperty misses a TypeScript::Monitor(cx, *vp) call.

Based on a testcase decoder reported yesterday on IRC.

Comment 1

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij (:jandem) from comment #0)
>
> Crashes with --ion-eager -n, I think because js::GetProperty misses a
> TypeScript::Monitor(cx, *vp) call.

I will fix this as part of bug 725357 (the type check in JIT-code is more efficient than the Monitor call).

Note that the testcase in comment 0 no longer crashes, but a slightly modified version still does:

function f(x) {
    if (x.y()) {};
}
f({y: function() {}});
f(10);