420612 - "Assertion failure: obj == pobj"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> this.__proto__ = []; this.unwatch("x");
Assertion failure: obj == pobj, at jsinterp.c:149

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

This happens because js_LookupPropertyWithFlags simply returns the current |protoIndex| if the next object on the prototype chain is not native. Perhaps it should be returning |protoIndex + 1|?

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Like so

Comment 3

[Bob Clary [:bc] (inactive)]

covered by js1_6/Array/regress-415540.js also

caused by bug 418139

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 306934 [details] [diff] [review]
Like so

Another easy fix, thanks. It's absolutely correct, since protoIndex is a hint only when non-zero. But it had better be non-zero in this case.

/be

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 306934 [details] [diff] [review]
Like so

a1.9b4=beltzner

Comment 6

[Brendan Eich [:brendan]]

Fix committed for mrbkap:

js/src/jsobj.c 3.444

/be

Comment 7

[Bob Clary [:bc] (inactive)]

also ecma_3/Array/regress-390598.js, js1_5/extensions/regress-390598.js

Comment 8

[Bob Clary [:bc] (inactive)]

Checking in regress-420612.js;
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-420612.js,v  <--  regress-420612.js
initial revision: 1.1

Comment 9

[Bob Clary [:bc] (inactive)]

This fails in the browser 
<http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=js1_5/extensions/regress-420612.js;language=type;text/javascript>

with FAILED! expected: invalid __proto__ value (can only be set to null)

Is that a browser only restriction? Should the testcase be modified to try to catch the exception?

Comment 10

[Brendan Eich [:brendan]]

$ grep 'only be set to null' xpconnect/src/*.cpp
xpconnect/src/XPCCrossOriginWrapper.cpp:      JS_ReportError(cx, "invalid __proto__ value (can only be set to null)");

(Nit: "can be set to null only" or "can be set only to null" would be better.)

/be

Comment 11

[Bob Clary [:bc] (inactive)]

/me should learn that new fangled grep thing.

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-420612.js,v  <--  regress-420612.js
new revision: 1.2; previous revision: 1.1

ping me or update the test yourself whoever changes the exception message.

Comment 12

[Bob Clary [:bc] (inactive)]

v 1.9.0