590664 - JM: jsreftest browser debug assert on js1_8/regress/regress-384412.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

Showed up on the tinderbox with the last merge:

Assertion failure: IsSaneThisObject(args.thisv().toObject()), at /builds/moz2_slave/jaegermonkey-linux-debug/build/js/src/jsinterp.cpp:609
NEXT ERROR TEST-UNEXPECTED-FAIL | file:///home/cltbld/talos-slave/jaegermonkey_fedora-debug_test-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_8/regress/regress-384412.js | Exited with code 1 during test run

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Patch

The patched line of code is in a new function. With eager-this, it should set NULL instead. Otherwise, we are trying to use a call object as 'this', which is deemed not sane. Because it's not.

Comment 2

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 469230 [details] [diff] [review]
Patch

Looks right. That thisv value is useless on the TM side, since |this| gets re-computed when it sees a js_CallClass object anyway (in ComputeThisFromArgv)...

Comment 3

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/projects/jaegermonkey/rev/0b49b8491cfe