597870 - "Assertion failure: 0,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
  (function() {
    __defineSetter__("x", Math.sin);
  } ());
} catch(e) {}
function::x =
Proxy.createFunction(function() {
  return {
    get: function() {
      return [];
    }
  };
} (),
function() {});

asserts js debug shell on TM changeset dfcf5611ce02 without -m or -j at Assertion failure: 0,

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Not sure this is a regression, it may date to E4X and the function namespace. Proxy.createFunction throws and we try to decompile the function::x = ... (JSOP_SETXMLNAME), but the decompiler never supported the necessary LHS -> RHS transformation, which the patch adds. I bet there is a testcase that does not depend on proxies.

/be

Comment 3

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/3559d9fded5f

/be

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/9f9e109033ed (fix test)

/be

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   42437:4dd9be00049c
user:        Andreas Gal
date:        Tue May 18 19:21:43 2010 -0700
summary:     Implement ES Harmony Proxies (bug 546590, r=mrbkap).

... but as mentioned this might not be accurate..

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3559d9fded5f

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-597870.js.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.