Closed Bug 585257 Opened 10 years ago Closed 10 years ago

"Assertion failure: obj == obj2,"

Categories

(Core :: JavaScript Engine, defect, critical)

defect
Not set
critical

Tracking

()

VERIFIED FIXED
Tracking Status
blocking2.0 --- beta5+

People

(Reporter: gkw, Assigned: jorendorff)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [compartments] fixed-in-tracemonkey)

Attachments

(1 file)

__proto__=evalcx('')
Function("__defineSetter__(\"__proto__\",function(){})")()

asserts js debug shell on TM changeset 785488c82d41 without -j at Assertion failure: obj == obj2, at ../jsapi.cpp:3502
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   44269:3aaaa21012c8
user:        Jason Orendorff
date:        Wed Jun 23 16:35:10 2010 -0500
summary:     Bug 563099 - Compartments and wrappers API. r=gal.
blocking2.0: --- → ?
OS: Linux → All
Hardware: x86 → All
blocking2.0: ? → beta5+
Assignee: general → jorendorff
To trigger this bug, (a) make an object whose prototype is a proxy; (b) call JS_GetPropertyDescriptorById on that object. __proto__ and the global object are not necessarily involved:

Object.create(evalcx('')).__defineSetter__('toString', function(){});

I think the assertion is just bogus.
Attached patch v1Splinter Review
Attachment #464016 - Flags: review?(gal)
Whiteboard: [compartments]
Attachment #464016 - Flags: review?(gal) → review+
This was checked in to TM..

http://hg.mozilla.org/tracemonkey/rev/569d6bc63ce2
Whiteboard: [compartments] → [compartments] fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/569d6bc63ce2
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-585257.js.
Flags: in-testsuite+
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.