634236 - Crash [@ JSCompartment::wrap] or "Assertion failure: isProxy(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: more info

(eval("\
  (function(){\
    b = {};\
    b.__proto__=evalcx('split');\
    print(b)\
    }\
  )\
"))()

asserts js debug shell on TM changeset e25c8949931d without -m nor -j at Assertion failure: isProxy(), and crashes js opt shell at JSCompartment::wrap.


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   62381:f8bec3eead64
user:        Andreas Gal
date:        Mon Feb 14 14:19:36 2011 -0800
summary:     Bug 633879 - Stop wrappers from holding old scopes alive. r=[e-mail],[e-mail], a=blocker

Comment 1

[Johnny Stenback (:jst)]

Recent regression, blocking, hard.

Comment 2

[Andreas Gal :gal]

Will work on it immediately.

Comment 3

[Andreas Gal :gal]

Attachment: patch

Comment 4

[Andreas Gal :gal]

Dumb bug, sorry.

Comment 5

[Andreas Gal :gal]

Thanks a ton for the quick turn-around Gary. This helped tremendously.

Comment 6

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/532ee628dc4f

Comment 7

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/532ee628dc4f

Comment 8

[Brendan Eich [:brendan]]

Comment on attachment 512534 [details] [diff] [review]
patch

>diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
>--- a/js/src/jscompartment.cpp
>+++ b/js/src/jscompartment.cpp
>@@ -175,17 +175,18 @@ JSCompartment::arenaListsAreEmpty()
>            return false;
>   }
>   return true;
> }
> 
> static bool
> IsCrossCompartmentWrapper(JSObject *wrapper)
> {
>-    return !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
>+    return wrapper->isWrapper() &&
>+           !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);

Nit: if it's a universal predicate as the type of wrapper implies, s/wrapper/obj/g

/be

Comment 9

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929