The default bug view has changed. See this FAQ.

TM: Assertion failure: isNumber(), at jsvalue.h:604

RESOLVED FIXED in mozilla8

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: Waldo)

Tracking

(Depends on: 1 bug, Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla8
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-done)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-inbound revision 8160165dfcb4:

unescape(it);

Bisect shows:

Changeset 71368:d2250fc608cc: bad
The first bad revision is:
changeset:   71368:d2250fc608cc
user:        Jeff Walden
date:        Fri Apr 01 15:24:21 2011 -0700
summary:     Bug 646129 - [[DefaultValue]] on Date objects is wrong when called with no hint.  r=luke


Although this issue was found using a mutation of the "prop_iter_trace" test for coverage increase in 669864, I don't see a direct connection there. If I'm wrong there and this function is related, let me know.
Created attachment 548535 [details] [diff] [review]
Patch

This is fallout from a minor adjustment to how the convert hook works -- added an assertion that makes the problem clearer.  I also went and updated JSClass.convert and JS_ConvertStub docs on MDN for this adjustment, while it was on the brain.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #548535 - Flags: review?(luke)

Updated

6 years ago
Attachment #548535 - Flags: review?(luke) → review+
http://hg.mozilla.org/integration/mozilla-inbound/rev/a774533fbbf1

<3 being able to push and not have to watch the tree.  :-)  (This was tryservered, in my defense, if this blows up in my face for some reason.)
OS: Linux → All
Hardware: x86_64 → All
Whiteboard: js-triage-needed → js-triage-done
Target Milestone: --- → mozilla8
http://hg.mozilla.org/mozilla-central/rev/a774533fbbf1
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 4

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.