Closed Bug 452960 Opened 11 years ago Closed 11 years ago

TM: "Assertion failure: !JSVAL_IS_PRIMITIVE(v)" with |new|

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: gal)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

js -j a.js
Assertion failure: !JSVAL_IS_PRIMITIVE(v), at jsbuiltins.cpp:471

a.js:
var f = function(){};
f.prototype = false;
for (let j=0;j<5;++j) { new f; }

Only happens when I feed a.js to ./js as a file, not when I paste its contents into the interactive shell.

Tracemonkey branch.
Summary: "Assertion failure: !JSVAL_IS_PRIMITIVE(v)" with |new| → TM: "Assertion failure: !JSVAL_IS_PRIMITIVE(v)" with |new|
We die on an assert in FastNewObject that says prototype must be object, which it here clearly isn't. As far as I can tell prototype becomes Object() in this case, but I can't figure out how to get a handle to Object() in FastNewObject.
Assignee: general → brendan
Assignee: brendan → gal
Attachment #338981 - Flags: review? → review?(mrbkap)
Comment on attachment 338981 [details] [diff] [review]
Use Object as prototype if the prototype of the constructor is primitive.

>diff -r ce9daaee1980 js/src/jsbuiltins.cpp
>+    if (JSVAL_IS_PRIMITIVE(v)) {
>+        if (!js_GetClassPrototype(cx, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]), 
>+                                  INT_TO_JSID(JSProto_Object), &proto))
>+            return NULL;
>+    } else 
>+        proto = JSVAL_TO_OBJECT(v);

Add lots of curly braces here and r=me.
Attachment #338981 - Flags: review?(mrbkap) → review+
http://hg.mozilla.org/tracemonkey/rev/504ac87ae2bf
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
/cvsroot/mozilla/js/tests/js1_7/regress/regress-452960.js,v  <--  regress-452960.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/70cc42a6572b
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.