Closed
Bug 580544
Opened 15 years ago
Closed 15 years ago
"Assertion failure: non-global object at end of scope chain,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
Tracking | Status | |
---|---|---|
blocking2.0 | --- | beta4+ |
People
(Reporter: gkw, Assigned: mrbkap)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file, 2 obsolete files)
3.29 KB,
patch
|
Details | Diff | Splinter Review |
new(this.prototype=this)
asserts js debug shell on TM tip without -j at Assertion failure: non-global object at end of scope chain, at ../jsobj.cpp:6175
![]() |
Reporter | |
Comment 1•15 years ago
|
||
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 47485:d770ef6237ea
user: Jason Orendorff
date: Wed Jun 16 16:13:28 2010 -0500
summary: Bug 570169 - Part 2, add assertions that gcthings do not leak across compartments. r=gal.
Blocks: 570169
Assignee | ||
Comment 2•15 years ago
|
||
We create a bogus object (no parent) before noticing that we're being asked to call the global object as a constructor. Given that ECMA-262 forbids the global object from having [[Call]] or [[Construct]] hooks, the easiest thing to do here might be to just catch this in js_InvokeConstructor and not bother creating the object.
Assignee | ||
Comment 3•15 years ago
|
||
Comment 4•15 years ago
|
||
Comment on attachment 459220 [details] [diff] [review]
Proposed fix
Oh, all right.
Attachment #459220 -
Flags: review?(jorendorff) → review+
Comment 5•15 years ago
|
||
did this land?
Updated•15 years ago
|
blocking2.0: ? → beta4+
Comment 6•15 years ago
|
||
Patch has rotted badly -- may not be needed (if not, then fixed for what bug?).
/be
Comment 7•15 years ago
|
||
This is still broken on TM tip.
Assignee | ||
Comment 8•15 years ago
|
||
Attachment #459220 -
Attachment is obsolete: true
Assignee | ||
Comment 9•15 years ago
|
||
Attachment #464585 -
Attachment is obsolete: true
Assignee | ||
Comment 10•15 years ago
|
||
Whiteboard: fixed-in-tracemonkey
Assignee | ||
Comment 11•15 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Comment 12•13 years ago
|
||
A testcase for this bug was automatically identified at js/src/tests/ecma_3/Regress/regress-580544.js.
Flags: in-testsuite+
![]() |
Reporter | |
Comment 13•13 years ago
|
||
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•