619970 - Assertion failure: data.s.payload.why == why, at jsvalue.h:527

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The code (might not be minimal)

function test_array_toString_sub_1()
{
  Object.defineProperty(arguments, 1, { value: 1 });
  arguments.join = [].join;
  assertEq([].toString.call(arguments), "1");
}
test_array_toString_sub_1(1, 2);

triggers the following assertion (tested on tracemonkey trunk):

Assertion failure: data.s.payload.why == why, at jsvalue.h:527

Comment 1

[Tom S. (please needinfo tschuster)]

Attachment: Fix arguments magic check

I made some small mistake in my GetElement addition for arguments. I assumed array holes, would be represented as JS_ARRAY_HOLE, but in fact JS_ARGS_HOLE, is the right thing. This patch should be safe to land, because it's only affects debug mode.

Comment 2

[Luke Wagner [:luke]]

Attachment: fix and test

Wow, great find; this goes back to fatvals.  IIUC, this is a debug-only failure and does not affect correctness (since magic values are singletons).

Comment 3

[Nicholas Nethercote [inactive]]

(In reply to comment #1)
> 
> I made some small mistake in my GetElement addition for arguments. I assumed
> array holes, would be represented as JS_ARRAY_HOLE, but in fact JS_ARGS_HOLE,
> is the right thing.

If you change "array holes" to "arguments holes" in that sentence it matches the patch, and makes more sense :)

Comment 4

[Jeff Walden [:Waldo]]

Comment on attachment 498431 [details] [diff] [review]
fix and test

+function test() {
+    delete arguments[1];
+    return Array.prototype.join.call(arguments);
+}
+assertEq(test(1,2,3), "1,,3");
+reportCompare(true,true);

Please add a second test that setting Object.prototype[1] will show through here too, just to be sure.

Comment 5

[Luke Wagner [:luke]]

Sounds good.
http://hg.mozilla.org/tracemonkey/rev/42bc53a5b27f

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/42bc53a5b27f