Bug 1375404 - Remove bogus assert, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 17 Jul 2017 10:28:24 -0600
changeset 369220 f9c4ffc88192dcf1070f1aec53533e4cf0709524
parent 369219 565499a7bd59e716a5bf3ed3441ba39eff751ffd
child 369221 44e71f8196d5640e7a7d581c824b8383f14542a7
push id32193
push userkwierso@gmail.com
push dateTue, 18 Jul 2017 00:27:59 +0000
treeherdermozilla-central@5e73b9798464 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1375404
milestone56.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1375404 - Remove bogus assert, r=jandem.
js/src/jit-test/tests/ion/bug1375404.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1375404.js
@@ -0,0 +1,10 @@
+// |jit-test| error:ReferenceError
+
+Object.prototype.f = 42;
+var T = TypedObject;
+var ObjectStruct = new T.StructType({f: T.Object});
+Object.prototype.f = 42;
+var o = new ObjectStruct();
+evaluate(`
+  o.f %= p;
+`);
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -7238,17 +7238,16 @@ IonBuilder::ensureDefiniteType(MDefiniti
         return def;
 
       default: {
         if (def->type() != MIRType::Value) {
             if (def->type() == MIRType::Int32 && definiteType == MIRType::Double) {
                 replace = MToDouble::New(alloc(), def);
                 break;
             }
-            MOZ_ASSERT(def->type() == definiteType);
             return def;
         }
         replace = MUnbox::New(alloc(), def, definiteType, MUnbox::Infallible);
         break;
       }
     }
 
     current->add(replace);