Closed
Bug 563120
Opened 15 years ago
Closed 15 years ago
"Assertion failure: !cx->throwing" with E4X, toString
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: luke)
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
1.88 KB,
patch
|
Waldo
:
review+
brendan
:
review+
|
Details | Diff | Splinter Review |
Based on js/src/tests/e4x/GC/regress-313952-02.js
var x = new XML("x");
x.function::toString = function() { throw 3; }
var y = new XML("y");
y.function::toString = function() { throw 3; }
x == y;
Assertion failure: !cx->throwing, at ../jsops.cpp:3611
Reporter | ||
Comment 1•15 years ago
|
||
This variant requires -j.
var x = new XML("text");
x.function::toString = function() {
throw 3;
}
var likeString = {
toString: function() { for (var i = 0; i != 4; ++i) {} }
};
x == likeString;
Assertion failure: r == MONITOR_ERROR, at ../jsops.cpp:871
![]() |
Assignee | |
Comment 2•15 years ago
|
||
The problem is that js_TextXMLEquality calls js_ValueToString twice in a row, only checking for failure after the second call. The first call throws, and the second blindly starts interpreting. So, this seems to be an interpreter bug; the assertions added by bug 560798 are just the first witnesses.
Updated•15 years ago
|
Attachment #442883 -
Attachment is patch: true
Attachment #442883 -
Attachment mime type: application/octet-stream → text/plain
![]() |
Assignee | |
Updated•15 years ago
|
Attachment #442883 -
Flags: review?(jwalden+bmo)
Comment 3•15 years ago
|
||
Comment on attachment 442883 [details] [diff] [review]
patch
Oh boy -- this goes back to 2004.
/be
Attachment #442883 -
Flags: review+
Updated•15 years ago
|
Attachment #442883 -
Flags: review?(jwalden+bmo) → review+
![]() |
||
Updated•15 years ago
|
Keywords: regression
![]() |
Assignee | |
Comment 4•15 years ago
|
||
Assignee: general → lw
Whiteboard: fixed-in-tracemonkey
![]() |
Assignee | |
Comment 5•15 years ago
|
||
Missed an init.
http://hg.mozilla.org/tracemonkey/rev/c6857d0b1e9f
Comment 7•15 years ago
|
||
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•