"Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h"

VERIFIED FIXED

Status

()

Core
JavaScript Engine
P2
critical
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: gkw, Assigned: mrbkap)

Tracking

(Blocks: 1 bug, {assertion, testcase, verified1.9.1})

Trunk
x86
Mac OS X
assertion, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
function f() { eval("with(arguments)throw <x/>;"); }
f();

asserts debug (TM not needed) shell at Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h:111 but seems to work as expected in opt.
Flags: blocking1.9.1?
(Reporter)

Comment 1

9 years ago
Nominated blocking1.9.1? because it suddenly kept on appearing in jsfunfuzz runs.
(Assignee)

Comment 2

9 years ago
Created attachment 360775 [details] [diff] [review]
Easiest fix

We're actually resolving the bogo jsid-turn-jsval JS_DEFAULT_XML_NAMESPACE_ID, but we could be resolving an object or a boolean (though the JSAPI, if no other way).
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #360775 - Flags: review?(brendan)
Attachment #360775 - Flags: review?(brendan) → review+
Comment on attachment 360775 [details] [diff] [review]
Easiest fix

Sick. I hate E4X (and ES4 namespaces, which might have wanted object jsids too). Trying to think less dark thoughts, since we have some commitments to our embedders who use E4X. Plus, the

http://wiki.ecmascript.org/doku.php?id=strawman:names

wants something out of the int/string jsid space (don't mention pseudo-booleans! I did once but I think I got away with it! :-P).

/be
(Assignee)

Comment 4

9 years ago
http://hg.mozilla.org/tracemonkey/rev/b7d5afd33dcf
Whiteboard: fixed-in-tracemonkey

Updated

9 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2

Comment 5

9 years ago
http://hg.mozilla.org/mozilla-central/rev/b7d5afd33dcf
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 6

9 years ago
http://hg.mozilla.org/mozilla-central/rev/db81c91e02ad
Flags: in-testsuite+
Flags: in-litmus-

Comment 8

9 years ago
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1

Comment 9

9 years ago
that was for e4x/Regress/regress-477053.js
You need to log in before you can comment on or make changes to this bug.