491965 - TM: "Assertion failure: JSVAL_IS_NUMBER(v)" with "new Number(/x/)"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> for (let i = 0; i < 5; ++i) print(new Number(/x/));
NaN
NaN
NaN
Assertion failure: JSVAL_IS_NUMBER(v), at ../jsnum.cpp:362

Comment 1

[Andreas Gal :gal]

confirmed

Comment 2

[Andreas Gal :gal]

Attachment: patch

We didn't properly signal to callNative that the slow native being called is a constructor. If we do so, the code falls on its face though in some old code that was trying to compensate for calling a builtin as constructor. We don't have any traceable constructors any more, so that special case code can be removed safely.

Cycling through the tryserver.

Comment 3

[Andreas Gal :gal]

Attachment: patch. one of these days I will learn how to attach patches

Comment 4

[Andreas Gal :gal]

Attachment: patch with testcase

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 487134 :

The first bad revision is:
changeset:   27516:b8cf788763a0
user:        jorendorff
date:        Tue May 05 14:26:06 2009 -0700
summary:     Record all calls to native functions (487134, r=gal, brendan).

Comment 6

[Graydon Hoare :graydon]

Comment on attachment 376340 [details] [diff] [review]
patch with testcase

I think you might have requested review on this but forgot to set the flag when you updated the patch? It looks fine to me but I don't really know that path well. Confirm with jorendorff maybe?

Comment 7

[Andreas Gal :gal]

Comment on attachment 376340 [details] [diff] [review]
patch with testcase

Yeah, Jason should take a look but in the meantime I think we can land it.

Comment 8

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/9cd4197a8cdc

Comment 9

[Andreas Gal :gal]

This is a regression for a patch that is not on branch. Should not block.

Comment 10

[Andreas Gal :gal]

Unblocking after consultation with damon and shaver.

Comment 11

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/9cd4197a8cdc

Comment 12

[Robert Sayre]

b+ because we're taking jason's patch on the branch.

Comment 13

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/c45e94a873ae

Comment 14

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed with testcase in comment 0 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422

Comment 15

[Bob Clary [:bc] (inactive)]

js1_8_1/trace/trace-test.js
http://hg.mozilla.org/tracemonkey/rev/61892f57b46a

Comment 16

[Bob Clary [:bc] (inactive)]

cvsroot/mozilla/js/tests/js1_8_1/trace/trace-test.js,v  <--  trace-test.js
new revision: 1.14; previous revision: 1.13

/cvsroot/mozilla/js/tests/shell.js,v  <--  shell.js