Last Comment Bug 674207 - TM: Assertion failure: isNumber(), at jsvalue.h:604
: TM: Assertion failure: isNumber(), at jsvalue.h:604
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
-- critical (vote)
: mozilla8
Assigned To: Jeff Walden [:Waldo] (remove +bmo to email)
: Jason Orendorff [:jorendorff]
Depends on: 669864
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-07-26 04:53 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:00 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (1.11 KB, patch)
2011-07-26 11:52 PDT, Jeff Walden [:Waldo] (remove +bmo to email)
luke: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-07-26 04:53:45 PDT
The following test asserts on mozilla-inbound revision 8160165dfcb4:


Bisect shows:

Changeset 71368:d2250fc608cc: bad
The first bad revision is:
changeset:   71368:d2250fc608cc
user:        Jeff Walden
date:        Fri Apr 01 15:24:21 2011 -0700
summary:     Bug 646129 - [[DefaultValue]] on Date objects is wrong when called with no hint.  r=luke

Although this issue was found using a mutation of the "prop_iter_trace" test for coverage increase in 669864, I don't see a direct connection there. If I'm wrong there and this function is related, let me know.
Comment 1 User image Jeff Walden [:Waldo] (remove +bmo to email) 2011-07-26 11:52:15 PDT
Created attachment 548535 [details] [diff] [review]

This is fallout from a minor adjustment to how the convert hook works -- added an assertion that makes the problem clearer.  I also went and updated JSClass.convert and JS_ConvertStub docs on MDN for this adjustment, while it was on the brain.
Comment 2 User image Jeff Walden [:Waldo] (remove +bmo to email) 2011-07-27 00:16:56 PDT

<3 being able to push and not have to watch the tree.  :-)  (This was tryservered, in my defense, if this blows up in my face for some reason.)
Comment 4 User image Christian Holler (:decoder) 2013-01-19 14:00:05 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.