844049 - Assertion failure: v.isBoolean(), at jsobj.cpp:4649

Status: RESOLVED DUPLICATE of bug 844048

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 885cde564ff3 (no options required):


function foo() {
  eval("\
    for (var arguments in arguments)\
      assertEq(f(i, 1), i+1);\
  ");
}
foo();

Comment 1

[Christian Holler (:decoder)]

Filing s-s because this is a possible type confusion. It looks very similar to bug 844048, so might be related. Please unhide if this is a safe thing.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122445:e3b899354a6f
user:        Brian Hackett
date:        Wed Feb 20 04:54:13 2013 -0700
summary:     Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.

This iteration took 0.716 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 2 :)

Comment 4

[Christian Holler (:decoder)]

Similar tests also cause:

Assertion failure: type == MIRType_Boolean || type == MIRType_Int32 || type == MIRType_Double || type == MIRType_String || type == MIRType_Object, at ion/MIR.h:1722