"Assertion failure: 0,"

VERIFIED FIXED in mozilla2.0b7

Status

()

P2
critical
VERIFIED FIXED
8 years ago
6 years ago

People

(Reporter: gkw, Assigned: brendan)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla2.0b7
assertion, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

8 years ago
try {
  (function() {
    __defineSetter__("x", Math.sin);
  } ());
} catch(e) {}
function::x =
Proxy.createFunction(function() {
  return {
    get: function() {
      return [];
    }
  };
} (),
function() {});

asserts js debug shell on TM changeset dfcf5611ce02 without -m or -j at Assertion failure: 0,
(Reporter)

Updated

8 years ago
blocking2.0: --- → ?
(Assignee)

Comment 1

8 years ago
Created attachment 476681 [details] [diff] [review]
fix
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #476681 - Flags: review?(igor)
(Assignee)

Updated

8 years ago
OS: Mac OS X → All
Priority: -- → P2
Hardware: x86 → All
Target Milestone: --- → mozilla2.0b7
(Assignee)

Comment 2

8 years ago
Not sure this is a regression, it may date to E4X and the function namespace. Proxy.createFunction throws and we try to decompile the function::x = ... (JSOP_SETXMLNAME), but the decompiler never supported the necessary LHS -> RHS transformation, which the patch adds. I bet there is a testcase that does not depend on proxies.

/be

Updated

8 years ago
Attachment #476681 - Flags: review?(igor) → review+
(Assignee)

Comment 3

8 years ago
http://hg.mozilla.org/tracemonkey/rev/3559d9fded5f

/be
Whiteboard: fixed-in-tracemonkey
(Reporter)

Comment 5

8 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   42437:4dd9be00049c
user:        Andreas Gal
date:        Tue May 18 19:21:43 2010 -0700
summary:     Implement ES Harmony Proxies (bug 546590, r=mrbkap).

... but as mentioned this might not be accurate..

Comment 6

8 years ago
http://hg.mozilla.org/mozilla-central/rev/3559d9fded5f
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED

Updated

8 years ago
blocking2.0: ? → betaN+
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-597870.js.
Flags: in-testsuite+
(Reporter)

Comment 8

6 years ago
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.