Closed
Bug 664951
Opened 12 years ago
Closed 12 years ago
"Assertion failure: !args.rval().isPrimitive() && callee != args.rval().toObject()" with fixed proxy
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: luke)
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
2.23 KB,
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
var handler = { fix: function() { return []; } };
var p = Proxy.createFunction(handler, function(){}, function(){});
Proxy.fix(p);
new p();
Assertion failure: !args.rval().isPrimitive() && callee != args.rval().toObject(), at js/src/jscntxtinlines.h:322
The first bad revision is:
changeset: 66c8ad02543b
user: Luke Wagner
date: Mon Aug 16 12:35:04 2010 -0700
summary: Bug 581263 - remove slow natives (r=waldo,mrbkap)
I guess this is a case that wasn't fixed by the patch in bug 593277.
|
Assignee | |
Comment 1•12 years ago
|
||
Thanks for the test-case. Looks like another exception to the assert added by proxies.
|
||
Updated•12 years ago
|
Attachment #540061 -
Flags: review?(jwalden+bmo) → review+
|
|
Assignee | |
Comment 2•12 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/a5a8d503df69
Whiteboard: fixed-in-tracemonkey
|
||
Comment 3•12 years ago
|
||
cdleary-bot mozilla-central merge info: http://hg.mozilla.org/mozilla-central/rev/a5a8d503df69
|
|
||
Updated•12 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
|
||
Comment 4•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•