The following testcase shows different behavior with no options vs. --no-ti on mozilla-central revision 20d1a5916ef6: var a = []; for (var i = 0; i < 1000; i++) { a.x = {} } a[i][0] = 0; $ opt64/js test.js test.js:5:0 TypeError: can't convert undefined to object $ opt64/js --no-ti test.js test.js:5:0 TypeError: a[i] is undefined This is a fuzzblocker because it keeps popping up very frequently.

Seeing the same also for null (foo is null vs. null has no properties).

I hate this code. We should just get rid of the special error message. This fixes it, but I am not sure if it has bad effects on other stuff.

Tom, is this patch up for a review?

I think we can take this patch, this should strictly just improve the error reporting.

Verified, still passes and fixes the issue.

Comment on attachment 698420 [details] [diff] [review] fix Review of attachment 698420 [details] [diff] [review]: ----------------------------------------------------------------- Looks good, but please add a testcase that fails without the patch (and works with the patch + --baseline-eager)

This fails with baseline at the moment.

Jan, any ideas on how to fix this?

(In reply to Tom Schuster [:evilpie] from comment #8) > Jan, any ideas on how to fix this? Changing ToObject to ToObjectFromStack in DoSetElemFallback seems to work for me..

You are right. Failure on my part.