Closed Bug 580544 Opened 12 years ago Closed 11 years ago

"Assertion failure: non-global object at end of scope chain,"

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

VERIFIED FIXED
Tracking Status
blocking2.0 --- beta4+

People

(Reporter: gkw, Assigned: mrbkap)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file, 2 obsolete files)

new(this.prototype=this)

asserts js debug shell on TM tip without -j at Assertion failure: non-global object at end of scope chain, at ../jsobj.cpp:6175
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   47485:d770ef6237ea
user:        Jason Orendorff
date:        Wed Jun 16 16:13:28 2010 -0500
summary:     Bug 570169 - Part 2, add assertions that gcthings do not leak across compartments. r=gal.
Blocks: 570169
We create a bogus object (no parent) before noticing that we're being asked to call the global object as a constructor. Given that ECMA-262 forbids the global object from having [[Call]] or [[Construct]] hooks, the easiest thing to do here might be to just catch this in js_InvokeConstructor and not bother creating the object.
Attached patch Proposed fix (obsolete) — Splinter Review
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #459220 - Flags: review?(jorendorff)
Comment on attachment 459220 [details] [diff] [review]
Proposed fix

Oh, all right.
Attachment #459220 - Flags: review?(jorendorff) → review+
did this land?
blocking2.0: ? → beta4+
Patch has rotted badly -- may not be needed (if not, then fixed for what bug?).

/be
This is still broken on TM tip.
Attached patch Updated to trunk (obsolete) — Splinter Review
Attachment #459220 - Attachment is obsolete: true
Attached patch Updated to trunkSplinter Review
Attachment #464585 - Attachment is obsolete: true
http://hg.mozilla.org/mozilla-central/rev/cf9fc9bb9c3e
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/tests/ecma_3/Regress/regress-580544.js.
Flags: in-testsuite+
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.