1355200 - Assertion failure: IsConstructor(args.CallArgs::newTarget()) (provided new.target value must be a constructor)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

test case:
---
var g = newGlobal();
var w = g.eval("Array");
var v = g.eval("() => {}");
var o = Reflect.construct(w, [], v);
---

Assertion failure:
---
Assertion failure: IsConstructor(args.CallArgs::newTarget()) (provided new.target value must be a constructor), at /home/andre/git/mozilla-central/js/src/vm/Interpreter.cpp:537
---


I'm now wondering if bug 1355016 is more severe than I thought, therefore I'm hiding this bug for the time being.

Comment 1

[Daniel Veditz [:dveditz]]

Till: Is this assertion a potential security problem or simply a correctness issue?

Comment 2

[Al Billings [:abillings - ex-MoCo]]

Jan, can you get anyone to look at this old bug?

Comment 3

[Jan de Mooij [:jandem]]

Till landed bug 1355016 which should fix this one as well. Till, should we backport this?

Comment 4

[Till Schneidereit [:till]]

(In reply to Jan de Mooij [:jandem] from comment #3)
> Till landed bug 1355016 which should fix this one as well. Till, should we
> backport this?

Maybe. I don't see how it could be a security problem, but it's also a very non-risky patch. I'll request uplift once the patch in bug 1355016 has gone to Nightly.

Comment 5

[Daniel Veditz [:dveditz]]

Unhiding based on comment 4