Closed Bug 843886 Opened 11 years ago Closed 11 years ago

BaselineCompiler: "Assertion failure: vp[1].isObject(),"

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: jandem)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack
__proto__["__noSuchMethod__"] = __proto__
''.t()

asserts js debug shell on ionmonkey changeset c8de14641060 without any CLI arguments at Assertion failure: vp[1].isObject(),
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   116269:e34e126f817e
user:        Jan de Mooij
date:        Mon Dec 17 10:55:02 2012 +0100
summary:     Bug 821315 - Compile BINDGNAME, SETPROP, SETGNAME, SETNAME. r=djvj
Blocks: 821315
Attached patch PatchSplinter Review
Nice testcase. CALLPROP should only handle __noSuchMethod__ if the operand is an object, not a primitive. I got the current check from Ion's getprop IC, but the IC is only used for objects so it's not a problem there.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #717006 - Flags: review?(kvijayan)
Attachment #717006 - Flags: review?(kvijayan) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/059520c7f8a7
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: