811561 - IonMonkey: Differential Testing: Getting TypeError: 'prototype' property of <function> is not an object

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase shows different behavior with options ---ion-eager vs. no options on m-c revision 1b0226622e94:


function InstanceOf( object_1, object_2, expect )
  result = object_1 instanceof object_2;
function GenB(value) {}
GenB.prototype = void 0;
InstanceOf(new GenB(), GenB);


$ debug64/js --ion-eager test.js
<no output or error>


$ debug64/js test.js
test.js:2:0 TypeError: 'prototype' property of function GenB(value) {} is not an object

Comment 1

[Tom S. (please needinfo tschuster)]

I am not seeing this.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   114177:d3ed5864b6eb
user:        Nicolas B. Pierron
date:        Mon Nov 26 19:08:37 2012 -0800
summary:     Bug 814177 - Use a callVM for generic InstanceOf cases. r=dvander

Assuming fixed by bug 814177.