580544 - "Assertion failure: non-global object at end of scope chain,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

new(this.prototype=this)

asserts js debug shell on TM tip without -j at Assertion failure: non-global object at end of scope chain, at ../jsobj.cpp:6175

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   47485:d770ef6237ea
user:        Jason Orendorff
date:        Wed Jun 16 16:13:28 2010 -0500
summary:     Bug 570169 - Part 2, add assertions that gcthings do not leak across compartments. r=gal.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

We create a bogus object (no parent) before noticing that we're being asked to call the global object as a constructor. Given that ECMA-262 forbids the global object from having [[Call]] or [[Construct]] hooks, the easiest thing to do here might be to just catch this in js_InvokeConstructor and not bother creating the object.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Comment 4

[Jason Orendorff [:jorendorff]]

Comment on attachment 459220 [details] [diff] [review]
Proposed fix

Oh, all right.

Comment 5

[Robert Sayre]

did this land?

Comment 6

[Brendan Eich [:brendan]]

Patch has rotted badly -- may not be needed (if not, then fixed for what bug?).

/be

Comment 7

[Sean Stangl [:sstangl]]

This is still broken on TM tip.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Updated to trunk

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Updated to trunk

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/cf9fc9bb9c3e

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/cf9fc9bb9c3e

Comment 12

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/ecma_3/Regress/regress-580544.js.

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.