593473 - "Assertion failure: callee != &vp[0].toObject()"

Status: RESOLVED DUPLICATE of bug 593277

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Testcase:
  var x = Proxy.createFunction({}, function (q) { return q; });
  try { new x(x); } catch(e) { print(e); }

Result:
  Assertion failure: callee != &vp[0].toObject(), at jscntxtinlines.h:639

The first bad revision is:
  changeset:   52720:66c8ad02543b
  user:        Luke Wagner <[e-mail]>
  date:        Mon Aug 16 12:35:04 2010 -0700
  summary:     Bug 581263 - remove slow natives (r=waldo,mrbkap)

This might be the same as bug 593277.

Comment 1

[Luke Wagner [:luke]]

This assertion is supposed to catch constructors forgetting to set the rval (which returns the callee), but, of course, it is technically valid to return the callee so this assertion is not technically valid.  I think it is a valid debugging aid, so rather than remove it, I think it should be changed to

  JS_ASSERT_IF(native != proxy_Construct, callee != &vp[0].toObject())

Comment 2

[Luke Wagner [:luke]]

Although not the same bug, fixed by bug 593277.