Assertion failure: val.isBoolean() || val.isSymbol(), at js/src/jsexn.cpp:1072 with BigInt
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr60 | --- | unaffected |
firefox65 | --- | unaffected |
firefox66 | --- | unaffected |
firefox67 | --- | fixed |
People
(Reporter: gkw, Assigned: terpri)
References
Details
(4 keywords, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
The following testcase crashes on mozilla-central revision 47048ef82b50 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):
(new WeakMap).set(BigInt(0), function() {});
Backtrace:
#0 js::ValueToSourceForError (cx=0x7ff914517000, val=..., bytes=...) at js/src/jsexn.cpp:1072
#1 0x00005618f0498d4d in js::ReportNotObjectWithName (cx=0x7ff914517000, name=0x5618ef2800a5 "WeakMap key", v=...) at js/src/vm/JSObject.cpp:110
#2 0x00005618f0773134 in js::WeakMapObject::set_impl (cx=0x7ff914517000, args=...) at js/src/builtin/WeakMapObject.cpp:116
#3 0x00005618f075b59e in JS::CallNonGenericMethod<&js::WeakMapObject::is, &js::WeakMapObject::set_impl> (cx=<optimized out>, args=...) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-x86_64-47048ef82b50/objdir-js/dist/include/js/CallNonGenericMethod.h:103
#4 js::WeakMapObject::set (cx=0x7ff914517000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/WeakMapObject.cpp:132
/snip
For detailed crash information, see attachment.
Reporter | ||
Comment 1•5 years ago
|
||
Reporter | ||
Comment 2•5 years ago
|
||
autobisectjs shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/4b74d76e55a8
user: Andy Wingo
date: Wed Feb 06 13:41:56 2019 +0000
summary: Bug 1522436 - Enable BigInt compilation by default r=jandem,terpri,froydnj
Andy, here's another BigInt one for you.
Assignee | ||
Comment 3•5 years ago
|
||
Assignee | ||
Updated•5 years ago
|
Pushed by rmaries@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b52799e37195
Check for BigInts in ValueToSourceForError r=arai
Comment 6•5 years ago
|
||
bugherder |
Updated•5 years ago
|
Updated•5 years ago
|
Description
•