Closed
Bug 843886
Opened 11 years ago
Closed 11 years ago
BaselineCompiler: "Assertion failure: vp[1].isObject(),"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Assigned: jandem)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
4.19 KB,
text/plain
|
Details | |
1.10 KB,
patch
|
djvj
:
review+
|
Details | Diff | Splinter Review |
__proto__["__noSuchMethod__"] = __proto__ ''.t() asserts js debug shell on ionmonkey changeset c8de14641060 without any CLI arguments at Assertion failure: vp[1].isObject(),
Reporter | ||
Comment 1•11 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 116269:e34e126f817e user: Jan de Mooij date: Mon Dec 17 10:55:02 2012 +0100 summary: Bug 821315 - Compile BINDGNAME, SETPROP, SETGNAME, SETNAME. r=djvj
Blocks: 821315
Assignee | ||
Comment 2•11 years ago
|
||
Nice testcase. CALLPROP should only handle __noSuchMethod__ if the operand is an object, not a primitive. I got the current check from Ion's getprop IC, but the IC is only used for objects so it's not a problem there.
Updated•11 years ago
|
Attachment #717006 -
Flags: review?(kvijayan) → review+
Assignee | ||
Comment 3•11 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/059520c7f8a7
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•