653782 - "Assertion failure: JS_IsArrayObject(cx, scx->replacer),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

JSON.stringify(/x/,<x/>)

asserts js debug shell on TM changeset 3dd6ec45084c without -m nor -j at:

Assertion failure: JS_IsArrayObject(cx, scx->replacer),

(part of backtrace):

#2  0x081d4335 in JS_Assert (s=0x83824c4 "JS_IsArrayObject(cx, scx->replacer)", file=0x838242c "/home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/json.cpp", ln=445)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/jsutil.cpp:89
#3  0x0813c540 in JO (cx=0x845c098, obj=0xf750e138, scx=0xffffc0fc) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/json.cpp:445
#4  0x0813ce0b in Str (cx=0x845c098, v=..., scx=0xffffc0fc) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/json.cpp:628
#5  0x0813d83a in js_Stringify (cx=0x845c098, vp=0xf76e4060, replacer=0xf7502118, space=..., sb=...) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/json.cpp:783
#6  0x0813b925 in js_json_stringify (cx=0x845c098, argc=2, vp=0xf76e4060) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/json.cpp:145
#7  0x0810fd68 in js::CallJSNative (cx=0x845c098, native=0x813b82d <js_json_stringify(JSContext*, uintN, js::Value*)>, argc=2, vp=0xf76e4060)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-tm-68358-3dd6ec45084c/compilePath/js/src/jscntxtinlines.h:277

Comment 1

[Jeff Walden [:Waldo]]

Attachment: Patch and test

Any case where the second argument to JSON.stringify is an object that's not an array and isn't callable will trigger this.  Stupid mistake on my part.

Comment 2

[Jeff Walden [:Waldo]]

Comment on attachment 529171 [details] [diff] [review]
Patch and test

Gonna try for a faster review on IRC to fix the regression faster, but if not, shouldn't be a huge problem.

Comment 3

[Paul Biggar]

Comment on attachment 529171 [details] [diff] [review]
Patch and test

Review of attachment 529171 [details] [diff] [review]:

Looks good.

Comment 4

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/49f49164c1d7

I also mis-tagged the following revision as being associated with this bug in its commit message:

http://hg.mozilla.org/tracemonkey/rev/34e8a687ea80

That's actually (drumroll please)...bug 653872.  (Note the last three digits of that bug and this one.)  Sigh.

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/34e8a687ea80
http://hg.mozilla.org/mozilla-central/rev/49f49164c1d7