563120 - "Assertion failure: !cx->throwing" with E4X, toString

Status: RESOLVED FIXED

Description

[Jesse Ruderman]

Based on js/src/tests/e4x/GC/regress-313952-02.js

var x = new XML("x");
x.function::toString = function() { throw 3; }
var y = new XML("y");
y.function::toString = function() { throw 3; }
x == y;

Assertion failure: !cx->throwing, at ../jsops.cpp:3611

Comment 1

[Jesse Ruderman]

This variant requires -j.

var x = new XML("text");
x.function::toString = function() {
  throw 3;
}
var likeString = {
  toString: function() { for (var i = 0; i != 4; ++i) {} }
};
x == likeString;

Assertion failure: r == MONITOR_ERROR, at ../jsops.cpp:871

Comment 2

[Luke Wagner [:luke]]

Created attachment 442883 [details] [diff] [review]
patch

The problem is that js_TextXMLEquality calls js_ValueToString twice in a row, only checking for failure after the second call.  The first call throws, and the second blindly starts interpreting.  So, this seems to be an interpreter bug; the assertions added by bug 560798 are just the first witnesses.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 442883 [details] [diff] [review]
patch

Oh boy -- this goes back to 2004.

/be

Comment 4

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/efab4df4fc6f

Comment 5

[Luke Wagner [:luke]]

Missed an init.
http://hg.mozilla.org/tracemonkey/rev/c6857d0b1e9f

Comment 6

[Luke Wagner [:luke]]

Ignore comment 5, wrong bug.

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/efab4df4fc6f