Closed Bug 491115 Opened 11 years ago Closed 11 years ago

"Assertion failure: obj != pobj, at ../jsobj.cpp" with eval, __proto__

Categories

(Core :: JavaScript Engine, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: igor)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

eval(" __proto__ = this");

asserts debug js shell without -j at Assertion failure: obj != pobj, at ../jsobj.cpp:286

autoBisect shows this is probably related to bug 489501 :

The first bad revision is:
changeset:   27510:f474676a65df
user:        Igor Bukanov
date:        Fri May 01 13:48:27 2009 -0700
summary:     bug 489501 - consolidating
Flags: blocking1.9.1?
Assignee: general → igor
My changes for the bug 489501 has shared the assert that obj != pobj with script assignments. So now the above assert is triggered for a trivial cases like:

var obj = {};
obj.__proto__ = obj;
Attached patch v1Splinter Review
fixing the assert to check only if the cycle detection check is not carried out
Attachment #375462 - Flags: review?(brendan)
Comment on attachment 375462 [details] [diff] [review]
v1

Sorry, I should have seen that one.

/be
Attachment #375462 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/c7515a091bff
Whiteboard: fixed-in-tracemonkey
Flags: blocking1.9.1? → blocking1.9.1+
http://hg.mozilla.org/mozilla-central/rev/c7515a091bff
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.