477053 - "Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() { eval("with(arguments)throw <x/>;"); }
f();

asserts debug (TM not needed) shell at Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h:111 but seems to work as expected in opt.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nominated blocking1.9.1? because it suddenly kept on appearing in jsfunfuzz runs.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Easiest fix

We're actually resolving the bogo jsid-turn-jsval JS_DEFAULT_XML_NAMESPACE_ID, but we could be resolving an object or a boolean (though the JSAPI, if no other way).

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 360775 [details] [diff] [review]
Easiest fix

Sick. I hate E4X (and ES4 namespaces, which might have wanted object jsids too). Trying to think less dark thoughts, since we have some commitments to our embedders who use E4X. Plus, the

http://wiki.ecmascript.org/doku.php?id=strawman:names

wants something out of the int/string jsid space (don't mention pseudo-booleans! I did once but I think I got away with it! :-P).

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/b7d5afd33dcf

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b7d5afd33dcf

Comment 6

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/db81c91e02ad

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/68ba5f887adb

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2

Comment 9

[Bob Clary [:bc] (inactive)]

that was for e4x/Regress/regress-477053.js