1303396 - Assertion failure: args[0].toObject().is<JSFunction>()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

Test case:
---
Reflect.construct(Function.prototype.bind.call(new Proxy(Array,{})), [1,2,3,4,5,6,7,8,9,10,11,12,13])
---

Asserts with:
---
Assertion failure: args[0].toObject().is<JSFunction>(), at /home/andre/git/mozilla-central/js/src/vm/SelfHosting.cpp:1910
---


Back trace:
---
Thread 1 "mozjs-debug" received signal SIGSEGV, Segmentation fault.
0x0000000000db7407 in intrinsic_ConstructFunction (cx=0x7ffff6965000, argc=3, vp=0x7ffff16142c0)
    at /home/andre/git/mozilla-central/js/src/vm/SelfHosting.cpp:1910
1910	    MOZ_ASSERT(args[0].toObject().is<JSFunction>());
(gdb) bt
#0  0x0000000000db7407 in intrinsic_ConstructFunction (cx=0x7ffff6965000, argc=3, vp=0x7ffff16142c0)
    at /home/andre/git/mozilla-central/js/src/vm/SelfHosting.cpp:1910
#1  0x0000000000d35afb in js::CallJSNative (cx=0x7ffff6965000, native=0xdb7311 <intrinsic_ConstructFunction(JSContext*, unsigned int, JS::Value*)>, 
    args=...) at /home/andre/git/mozilla-central/js/src/jscntxtinlines.h:235
#2  0x0000000000cf9a0e in js::InternalCallOrConstruct (cx=0x7ffff6965000, args=..., construct=js::NO_CONSTRUCT)
    at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:455
#3  0x0000000000cf9d4f in InternalCall (cx=0x7ffff6965000, args=...) at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:500
#4  0x0000000000cf9d8d in js::CallFromStack (cx=0x7ffff6965000, args=...) at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:506
#5  0x0000000000d075d1 in Interpret (cx=0x7ffff6965000, state=...) at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:2919
#6  0x0000000000cf9667 in js::RunScript (cx=0x7ffff6965000, state=...) at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:401
#7  0x0000000000cf9ace in js::InternalCallOrConstruct (cx=0x7ffff6965000, args=..., construct=js::NO_CONSTRUCT)
    at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:473
#8  0x0000000000cf9d4f in InternalCall (cx=0x7ffff6965000, args=...) at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:500
#9  0x0000000000cf9d8d in js::CallFromStack (cx=0x7ffff6965000, args=...) at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:506
#10 0x000000000117bd50 in js::jit::DoCallFallback (cx=0x7ffff6965000, frame=0x7fffffffad68, stub_=0x7ffff17318c0, argc=3, vp=0x7fffffffacd8, res=...)
    at /home/andre/git/mozilla-central/js/src/jit/BaselineIC.cpp:5998
...
---

Comment 1

[André Bargull [:anba]]

Attachment: bug1303396.patch

Comment 2

[Till Schneidereit [:till]]

Comment on attachment 8798724 [details] [diff] [review]
bug1303396.patch

Review of attachment 8798724 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/261f1b97c5d8
Don't assert when calling intrinsic_ConstructFunction with non-JSFunction. r=till

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/261f1b97c5d8