Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 15 years ago

(function() {
  let(z) {
    for each(b in [{}]) { ({
        __noSuchMethod__ getter: Function
      }).w()
    }
  }
})()

asserts js debug shell with -m on JM tip at Assertion failure: !JSVAL_IS_PRIMITIVE(vp[1]), at ../jsinterp.cpp:870

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 1 • 15 years ago

This bug is kind of horrible. The code for CALLPROP calls a stub call, and the stack is adjusted afterward. Most stub calls work this way. The problem is that with the contiguous stack patch, Invoke() is going to take cx->regs->sp as the basis for the new frame, and smash the value at |sp[0]|.

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 2 • 15 years ago

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/2caa6834a5cb

	Christian Holler (:decoder)
	Comment 3 • 12 years ago

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug555922.js.