637014 - "Assertion failure: compartment mismatched" with makeFinalizeObserver

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
var o = newGlobal('new-compartment');
o.makeFinalizeObserver();
--
This seems to be shell-only, but it would be nice to fix this for fuzzers.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Stack trace

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   62765:6e2ee1f3f6c6
user:        Brendan Eich
date:        Wed Feb 23 19:38:27 2011 -0800
summary:     Followup fixes and tests in wake of global |this| binding change (636364, r=luke/gal/dvander, thanks to Waldo for the newGlobal shell function).

Hope for .x

Comment 3

[Andreas Gal :gal]

Shell only, NPOTB, can't block by definition, but definitely something we should fix right away.

Comment 4

[Andreas Gal :gal]

Attachment: patch

Ah JS_GetGlobalObject, we love you so much.

Comment 5

[Andreas Gal :gal]

Gary, you can push this patch after luke reviewed it.

Comment 6

[Luke Wagner [:luke]]

Comment on attachment 515374 [details] [diff] [review]
patch

can haz JS_GetGlobalForScopeChain instead?

Comment 7

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/654fdf0a3355

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/654fdf0a3355

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug637014.js.