[INFER] Avoid bogus assertion in AssertValidPropertyCacheHit, bug 678087.
authorBrian Hackett <bhackett1024@gmail.com>
Fri, 12 Aug 2011 07:54:15 -0700
changeset 76119 0a8195cb7590cc4c803adced8fea4c1f99b34c03
parent 76118 1f767f82d1c309e5f69364f1ddcb24d1f5eff0f9
child 76120 409b62513ac6ad4a1c2287376fb59ead21fe7550
push id3
push userfelipc@gmail.com
push dateFri, 30 Sep 2011 20:09:13 +0000
bugs678087
milestone8.0a1
[INFER] Avoid bogus assertion in AssertValidPropertyCacheHit, bug 678087.
js/src/jit-test/tests/basic/bug678087.js
js/src/jsinterp.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug678087.js
@@ -0,0 +1,8 @@
+
+i = 0;
+do {
+with({
+    TestCase: Float64Array
+}) for each(let TestCase in [TestCase]) {}
+ } while (i++ < 10);
+function TestCase(n, d, e, a) {}
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1589,17 +1589,18 @@ AssertValidPropertyCacheHit(JSContext *c
     else
         atom = cx->runtime->atomState.lengthAtom;
 
     JSObject *obj, *pobj;
     JSProperty *prop;
     JSBool ok;
 
     if (JOF_OPMODE(*regs.pc) == JOF_NAME) {
-        ok = js_FindProperty(cx, ATOM_TO_JSID(atom), false, &obj, &pobj, &prop);
+        bool global = js_CodeSpec[*regs.pc].format & JOF_GNAME;
+        ok = js_FindProperty(cx, ATOM_TO_JSID(atom), global, &obj, &pobj, &prop);
     } else {
         obj = start;
         ok = js_LookupProperty(cx, obj, ATOM_TO_JSID(atom), &pobj, &prop);
     }
     if (!ok)
         return false;
     if (cx->runtime->gcNumber != sample)
         JS_PROPERTY_CACHE(cx).restore(&savedEntry);