684586 - Assertion failure: isNative(), at ../../jsobjinlines.h:1088

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision a351ae35f2c4 (no options required):


Reflect.parse(this, arguments);


Note: The specified mozilla-central revision had a build problem with standalone shell, patch from http://hg.mozilla.org/integration/mozilla-inbound/rev/fff3dc9478ce fixes the build issues.

Comment 1

[Brian Hackett [Laid off!]]

Reflect.parse calls GetPropertyDefault with its argument, which seems to expect a native object.  The bug seems to be in GetPropertyDefault, though it's hard to tell in the jsobj.cpp functions when various objects are required to be natives.

Comment 2

[Dave Herman [:dherman]]

If GetPropertyDefault is supposed to work on all objects, it's definitely got a bug. It calls LookupPropertyWithDefaults which calls LookupPropertyWithDefaultsInline which calls obj->nativeLookup().

Waldo, care to weigh in?

Thanks,
Dave

Comment 3

[Jeff Walden [:Waldo]]

(In reply to Dave Herman [:dherman] from comment #2)

This is what comes of having too many API verbs that are not like the spec verbs.  :-\  Probably it should work on all objects, seeing as it's the implementation of a JSAPI method to get a property or a default value, in its absence.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 634180132e68).

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 63c4b0f66a0c).

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   118493:f4671ccc4502
user:        Brian Hackett
date:        Thu Jan 10 17:53:11 2013 -0700
summary:     Bug 827490 - Allow native objects to have both slots and dense elements, rm dense/slow array distinction, r=billm, dvander.

This iteration took 118.894 seconds to run.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This assertion came back in the form of bug 829821 after bug 827490 landed, but the testcase seemed different enough to warrant a new bug.

Comment 8

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 9

[Jan de Mooij [:jandem]]

Works fine nowadays, also with s/arguments/scriptArgs/