Closed Bug 563120 Opened 15 years ago Closed 15 years ago

"Assertion failure: !cx->throwing" with E4X, toString

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: luke)

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

Based on js/src/tests/e4x/GC/regress-313952-02.js var x = new XML("x"); x.function::toString = function() { throw 3; } var y = new XML("y"); y.function::toString = function() { throw 3; } x == y; Assertion failure: !cx->throwing, at ../jsops.cpp:3611
This variant requires -j. var x = new XML("text"); x.function::toString = function() { throw 3; } var likeString = { toString: function() { for (var i = 0; i != 4; ++i) {} } }; x == likeString; Assertion failure: r == MONITOR_ERROR, at ../jsops.cpp:871
Attached patch patchSplinter Review
The problem is that js_TextXMLEquality calls js_ValueToString twice in a row, only checking for failure after the second call. The first call throws, and the second blindly starts interpreting. So, this seems to be an interpreter bug; the assertions added by bug 560798 are just the first witnesses.
Attachment #442883 - Attachment is patch: true
Attachment #442883 - Attachment mime type: application/octet-stream → text/plain
Attachment #442883 - Flags: review?(jwalden+bmo)
Comment on attachment 442883 [details] [diff] [review] patch Oh boy -- this goes back to 2004. /be
Attachment #442883 - Flags: review+
Attachment #442883 - Flags: review?(jwalden+bmo) → review+
Assignee: general → lw
Whiteboard: fixed-in-tracemonkey
Ignore comment 5, wrong bug.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: