580931 - JM: "Assertion failure: isBoolean(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

with({e:[this].map(true.toString)}){}

asserts js debug shell on JM changeset 7c6f62fcbd91 without -m or -j at Assertion failure: isBoolean(), at ../jsvalue.h:546

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This has to do with our eager this changes.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: Proposed fix

The problem here is that "this" is null. Consequently, js_GetPrimitiveThis doesn't ensure that it's an instance of clasp (in this case, a boolean). This causes a later toBoolean call to fail.

This patch simply does the clasp test in the null case.

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

Looks good. Note the very reduced testcase:

var bts = true.toString;
bts(1.234);

JSOP_CALLNAME pushes a null |this| value when retrieving the bts identifier.

Comment 4

[Jason Orendorff [:jorendorff]]

Needs a test, preferably the one in comment 3. r=me with that.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: Patch with test included

Here's a new patch that includes a test that passes on the patched version and fails on unpatched.

Comment 6

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/projects/jaegermonkey/rev/21f93afcf5e2

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug580931-2.js.