901380 - Assertion failure: obj->isNative(), at js/src/json.cpp:728

Status: RESOLVED DUPLICATE of bug 901351

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

The following test case asserts with: obj->isNative(), at js/src/json.cpp:728


JSON.parse('{"a":0, "b":1}', function(n, v) {
  if (n == "a") {
    Object.defineProperty(this, "b", {value: new Int8Array(new ArrayBuffer(4))})
  }
  return v
})

Comment 1

[André Bargull [:anba]]

Simplified test case with arrays as mentioned in bug 901351 comment 1:

JSON.parse('[0, 1]', function(n, v) {
  if (n == "0") {
    this[1] = new Int8Array(1);
  }
  return v;
})

Comment 2

[Jeff Walden [:Waldo]]

Uh...DefineNativeProperty on a non-native object, without looking super-closely into things, sounds bad enough to give me the heebie-jeebies.  Closing, taking.

Comment 3

[Jeff Walden [:Waldo]]

I hid the comment in bug 901351 that mentions this possibility, just to be safe.  All but certainly both bugs will be fixed at once, but I think only this part of it is the worrisome part.

Comment 4

[Jeff Walden [:Waldo]]

Eh, this is close enough to the other bug in effect, once you consider that release builds will ignore all these assertion failures and just merrily continue along executing into conceptually-bogus code.  Fun fun fun!