Closed
Bug 684586
Opened 13 years ago
Closed 8 years ago
Assertion failure: isNative(), at ../../jsobjinlines.h:1088
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: js-triage-needed [jsbugmon:origRev=fff3dc9478ce])
Attachments
(1 file)
1.11 KB,
text/plain
|
Details |
The following test asserts on mozilla-central revision a351ae35f2c4 (no options required): Reflect.parse(this, arguments); Note: The specified mozilla-central revision had a build problem with standalone shell, patch from http://hg.mozilla.org/integration/mozilla-inbound/rev/fff3dc9478ce fixes the build issues.
Comment 1•13 years ago
|
||
Reflect.parse calls GetPropertyDefault with its argument, which seems to expect a native object. The bug seems to be in GetPropertyDefault, though it's hard to tell in the jsobj.cpp functions when various objects are required to be natives.
Reporter | ||
Updated•12 years ago
|
Whiteboard: js-triage-needed → js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce]
Reporter | ||
Updated•12 years ago
|
Whiteboard: js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce] → js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce]
Comment 2•12 years ago
|
||
If GetPropertyDefault is supposed to work on all objects, it's definitely got a bug. It calls LookupPropertyWithDefaults which calls LookupPropertyWithDefaultsInline which calls obj->nativeLookup(). Waldo, care to weigh in? Thanks, Dave
Comment 3•12 years ago
|
||
(In reply to Dave Herman [:dherman] from comment #2) This is what comes of having too many API verbs that are not like the spec verbs. :-\ Probably it should work on all objects, seeing as it's the implementation of a JSAPI method to get a property or a default value, in its absence.
Reporter | ||
Updated•12 years ago
|
Whiteboard: js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce] → js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce,ignore]
Reporter | ||
Comment 4•12 years ago
|
||
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 634180132e68).
Reporter | ||
Updated•12 years ago
|
Whiteboard: js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce,ignore] → js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce]
Reporter | ||
Updated•11 years ago
|
Whiteboard: js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce] → js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce,ignore]
Reporter | ||
Comment 5•11 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 63c4b0f66a0c).
Reporter | ||
Updated•11 years ago
|
Whiteboard: js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce,ignore] → js-triage-needed [jsbugmon:origRev=fff3dc9478ce,bisectfix]
Reporter | ||
Updated•11 years ago
|
Whiteboard: js-triage-needed [jsbugmon:origRev=fff3dc9478ce,bisectfix] → js-triage-needed [jsbugmon:origRev=fff3dc9478ce]
Reporter | ||
Comment 6•11 years ago
|
||
JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 118493:f4671ccc4502 user: Brian Hackett date: Thu Jan 10 17:53:11 2013 -0700 summary: Bug 827490 - Allow native objects to have both slots and dense elements, rm dense/slow array distinction, r=billm, dvander. This iteration took 118.894 seconds to run.
Comment 7•11 years ago
|
||
This assertion came back in the form of bug 829821 after bug 827490 landed, but the testcase seemed different enough to warrant a new bug.
Reporter | ||
Comment 8•11 years ago
|
||
Assignee | ||
Updated•10 years ago
|
Assignee: general → nobody
Comment 9•8 years ago
|
||
Works fine nowadays, also with s/arguments/scriptArgs/
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•