418540 - Assertion failure: OBJ_IS_NATIVE(obj)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Attachment: gdb session with commands suggested by brendan

I'm getting this a lot today:

Assertion failure: OBJ_IS_NATIVE(obj), at /Users/jruderman/trunk/mozilla/js/src/jslock.c:1222

Brendan says he understands what is wrong and that this is a regression from bug 418239.

Comment 1

[Jesse Ruderman]

Attachment: testcase (triggers a fatal assertion when loaded)

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Testing welcome. I'm in the middle of a huge patch...

/be

Comment 3

[Jesse Ruderman]

The patch fixes the crash and makes both try..catches produce reasonable error
messages (NS_ERROR_INVALID_POINTER from nsIDOMHTMLDivElement.appendChild for
the first, "r.appendChild is not a function" for the second).

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 304422 [details] [diff] [review]
fix

r=shaver, can someone run this in the suites?  I'm out today and tomorrow on a little speaking gig, and Brendan is deep in other important magicks.

Comment 5

[Bob Clary [:bc] (inactive)]

I can test on linux today.

Comment 6

[Brendan Eich [:brendan]]

Fixing, my testsuite passed and bc's more exhaustive tests are in flight (he'll report regressions, if any, later today or tomorrow -- I don't expect any, this patch is pure conservatism).

js/src/jsinterp.c 3.439
js/src/jsinterp.h 3.76

/be

Comment 7

[Bob Clary [:bc] (inactive)]

Attachment: debug test differences

Comment 8

[Bob Clary [:bc] (inactive)]

Attachment: opt test differences

note there were no differences in the shell results, only browser.

Comment 9

[Brendan Eich [:brendan]]

Comment on attachment 304691 [details] [diff] [review]
opt test differences

This is dire. Please file a bug? I have no idea why in-browser differs from shell, but the bus errors suggest GC pain. Cc the usual suspects ;-).

/be

Comment 10

[Brendan Eich [:brendan]]

Also, now that I've committed, can you reproduce these in-browser-only failures with a pure trunk pull of the entire firefox source tree? Thanks,

/be

Comment 11

[Bob Clary [:bc] (inactive)]

I'm rebuilding locally to check on just that. I've also repulled the 1.9.0 tree and the 1.9.0 test tree to make sure they are in sync and have reverted the patch on the test tree. I'll run another set of tests on each and compare to make sure I haven't screwed the pooch here. The seneca box I'm using is pretty fast and I should have some definite results for you when you get up.

Comment 12

[Bob Clary [:bc] (inactive)]

I think my test results were bogus. I can't reproduce the crashes locally with a fresh trunk build on linux.

ecma/String/15.5.4.6-2.js, js1_5/Scope/scope-003.js still have the window.toString() differences and the bad this is still there, but are known problems and unrelated to this bug. 

This is confirmed from the test runs starting at midnight at <http://tinderbox.mozilla.org/showbuilds.cgi?tree=MozillaTest>

I have another check when the tests complete later this morning on the seneca box.

Comment 13

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-418540.js,v  <--  regress-418540.js
initial revision: 1.1

Comment 14

[Bob Clary [:bc] (inactive)]

v