Last Comment Bug 664951 - "Assertion failure: !args.rval().isPrimitive() && callee != args.rval().toObject()" with fixed proxy
: "Assertion failure: !args.rval().isPrimitive() && callee != args.rval().toObj...
Status: RESOLVED FIXED
fixed-in-tracemonkey
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: 326633
  Show dependency treegraph
 
Reported: 2011-06-17 00:57 PDT by Jesse Ruderman
Modified: 2013-01-19 14:04 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
add another case to assert (2.23 KB, patch)
2011-06-17 08:53 PDT, Luke Wagner [:luke]
jwalden+bmo: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2011-06-17 00:57:13 PDT
var handler = { fix: function() { return []; } };
var p = Proxy.createFunction(handler, function(){}, function(){});
Proxy.fix(p);
new p();

Assertion failure: !args.rval().isPrimitive() && callee != args.rval().toObject(), at js/src/jscntxtinlines.h:322

The first bad revision is:
changeset:   66c8ad02543b
user:        Luke Wagner
date:        Mon Aug 16 12:35:04 2010 -0700
summary:     Bug 581263 - remove slow natives (r=waldo,mrbkap)

I guess this is a case that wasn't fixed by the patch in bug 593277.
Comment 1 Luke Wagner [:luke] 2011-06-17 08:53:06 PDT
Created attachment 540061 [details] [diff] [review]
add another case to assert

Thanks for the test-case.  Looks like another exception to the assert added by proxies.
Comment 2 Luke Wagner [:luke] 2011-06-17 17:01:37 PDT
http://hg.mozilla.org/tracemonkey/rev/a5a8d503df69
Comment 3 Chris Leary [:cdleary] (not checking bugmail) 2011-06-20 17:15:22 PDT
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/a5a8d503df69
Comment 4 Christian Holler (:decoder) 2013-01-19 14:04:18 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.