Closed Bug 477053 Opened 11 years ago Closed 11 years ago

"Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h"

Categories

(Core :: JavaScript Engine, defect, P2, critical)

x86
macOS
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: gkw, Assigned: mrbkap)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, verified1.9.1, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

function f() { eval("with(arguments)throw <x/>;"); }
f();

asserts debug (TM not needed) shell at Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h:111 but seems to work as expected in opt.
Flags: blocking1.9.1?
Nominated blocking1.9.1? because it suddenly kept on appearing in jsfunfuzz runs.
Attached patch Easiest fixSplinter Review
We're actually resolving the bogo jsid-turn-jsval JS_DEFAULT_XML_NAMESPACE_ID, but we could be resolving an object or a boolean (though the JSAPI, if no other way).
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #360775 - Flags: review?(brendan)
Attachment #360775 - Flags: review?(brendan) → review+
Comment on attachment 360775 [details] [diff] [review]
Easiest fix

Sick. I hate E4X (and ES4 namespaces, which might have wanted object jsids too). Trying to think less dark thoughts, since we have some commitments to our embedders who use E4X. Plus, the

http://wiki.ecmascript.org/doku.php?id=strawman:names

wants something out of the int/string jsid space (don't mention pseudo-booleans! I did once but I think I got away with it! :-P).

/be
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
http://hg.mozilla.org/mozilla-central/rev/b7d5afd33dcf
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/mozilla-central/rev/db81c91e02ad
Flags: in-testsuite+
Flags: in-litmus-
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
that was for e4x/Regress/regress-477053.js
You need to log in before you can comment on or make changes to this bug.