Crash [@ JSCompartment::wrap] or "Assertion failure: isProxy(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Assigned: gal)

Tracking

(Blocks: 1 bug, 5 keywords)

Trunk
x86
Linux
assertion, crash, regression, reproducible, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: [ccbr][hardblocker][has patch], fixed-in-tracemonkey, crash signature)

Attachments

(2 attachments)

(Reporter)

Description

7 years ago
Created attachment 512450 [details]
more info

(eval("\
  (function(){\
    b = {};\
    b.__proto__=evalcx('split');\
    print(b)\
    }\
  )\
"))()

asserts js debug shell on TM changeset e25c8949931d without -m nor -j at Assertion failure: isProxy(), and crashes js opt shell at JSCompartment::wrap.


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   62381:f8bec3eead64
user:        Andreas Gal
date:        Mon Feb 14 14:19:36 2011 -0800
summary:     Bug 633879 - Stop wrappers from holding old scopes alive. r=mrbkap@gmail.com,jst@mozilla.com, a=blocker
Recent regression, blocking, hard.
Assignee: general → gal
blocking2.0: ? → betaN+
Whiteboard: [ccbr] → [ccbr][hardblocker]
(Assignee)

Comment 2

7 years ago
Will work on it immediately.
(Assignee)

Comment 3

7 years ago
Created attachment 512534 [details] [diff] [review]
patch
(Assignee)

Updated

7 years ago
Attachment #512534 - Flags: review?(mrbkap)
(Assignee)

Updated

7 years ago
Whiteboard: [ccbr][hardblocker] → [ccbr][hardblocker][has patch]
(Assignee)

Comment 4

7 years ago
Dumb bug, sorry.

Updated

7 years ago
Attachment #512534 - Flags: review?(mrbkap) → review+
(Assignee)

Comment 5

7 years ago
Thanks a ton for the quick turn-around Gary. This helped tremendously.
(Assignee)

Comment 6

7 years ago
http://hg.mozilla.org/tracemonkey/rev/532ee628dc4f
Whiteboard: [ccbr][hardblocker][has patch] → [ccbr][hardblocker][has patch], fixed-in-tracemonkey
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Comment on attachment 512534 [details] [diff] [review]
patch

>diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
>--- a/js/src/jscompartment.cpp
>+++ b/js/src/jscompartment.cpp
>@@ -175,17 +175,18 @@ JSCompartment::arenaListsAreEmpty()
>            return false;
>   }
>   return true;
> }
> 
> static bool
> IsCrossCompartmentWrapper(JSObject *wrapper)
> {
>-    return !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
>+    return wrapper->isWrapper() &&
>+           !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);

Nit: if it's a universal predicate as the type of wrapper implies, s/wrapper/obj/g

/be
Crash Signature: [@ JSCompartment::wrap]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.