837873 - Getting "TypeError: can't convert id to primitive type" with Ion/TI only

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test causes an error on mozilla-central revision de946331d886 depending on options used:


var counter = 0;
var p = Proxy.create({
    has : function(id) {
            ++counter;
            if (counter == (12)) {
                obj.__proto__ = null;
            return true;
        }
    },
    get : function(id) {
        if (id == 'xyz')
            return 10;
    }
});
    obj = { xyz: 1};
    for (var i = 0; i != 100; ++i) {
        var s = obj.xyz;
        if (i == 10) {
            delete obj.xyz;
            Object.prototype.__proto__ = p;
    }
}


$ js test.js
test.js:15:0 TypeError: can't convert id to primitive type

$ js --no-ti test.js
<no output>


Found this one because it's one of the regression tests that are automatically added to jit-tests, that fail. I'm leaving this one out for now, so when fixing this, please add this test! :)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, would this still be valid? What has --no-ti become nowadays?

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)

Jan, would this still be valid? What has --no-ti become nowadays?

I think we can close this. TI is now enabled unconditionally so --no-ti no longer exists.