729813 - IonMonkey: Assertion failure: index < natoms, at ../../jsscript.h:731

Status: RESOLVED DUPLICATE of bug 732860

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 5a04fd69aa09 (run with --ion -n -m --ion-eager), tested on 64 bit:


function trySetProperty(o, p, v, strict) {
  function strictSetProperty() {
    "use strict";
    o[p] = v;
  }
  try  {
      strictSetProperty();
  }  catch (e)  {
    return "throw";
  }
}
var slowArray = [1, 2, 3];
var objs = [{}, { 1: 2 }, { a: 3 }, [], [1], [, 1], slowArray, function a(){}, /a/];
for (var i = 0, sz = objs.length; i < sz; i++) {
  var o = objs[i];
  var o2 = Object.preventExtensions(o);
  assertEq(trySetProperty(o, "baz", (4), true), "throw", "object " + i);
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

The bug here is that this calls js_GetTopStackFrame() instead of using scriptedCaller or StackIter, but neither really work properly with Ion yet. bug 730111 is the first step to fixing that.

Comment 2

[Nicolas B. Pierron [:nbp]]

Gary told me that when we fix a bug you file 2, but apparently you are cheating! :)

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 732860).