Assertion failure: isNative(), at ../../jsobjinlines.h:1088

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
7 years ago
2 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed [jsbugmon:origRev=fff3dc9478ce])

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
The following test asserts on mozilla-central revision a351ae35f2c4 (no options required):


Reflect.parse(this, arguments);


Note: The specified mozilla-central revision had a build problem with standalone shell, patch from http://hg.mozilla.org/integration/mozilla-inbound/rev/fff3dc9478ce fixes the build issues.
Reflect.parse calls GetPropertyDefault with its argument, which seems to expect a native object.  The bug seems to be in GetPropertyDefault, though it's hard to tell in the jsobj.cpp functions when various objects are required to be natives.
(Reporter)

Updated

6 years ago
Whiteboard: js-triage-needed → js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce]
(Reporter)

Updated

6 years ago
Whiteboard: js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce] → js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce]
If GetPropertyDefault is supposed to work on all objects, it's definitely got a bug. It calls LookupPropertyWithDefaults which calls LookupPropertyWithDefaultsInline which calls obj->nativeLookup().

Waldo, care to weigh in?

Thanks,
Dave

Comment 3

6 years ago
(In reply to Dave Herman [:dherman] from comment #2)

This is what comes of having too many API verbs that are not like the spec verbs.  :-\  Probably it should work on all objects, seeing as it's the implementation of a JSAPI method to get a property or a default value, in its absence.
(Reporter)

Updated

6 years ago
Whiteboard: js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce] → js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce,ignore]
(Reporter)

Comment 4

6 years ago
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 634180132e68).
(Reporter)

Updated

6 years ago
Whiteboard: js-triage-needed [jsbugmon:update,reconfirm,origRev=fff3dc9478ce,ignore] → js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce]
(Reporter)

Updated

5 years ago
Whiteboard: js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce] → js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce,ignore]
(Reporter)

Comment 5

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 63c4b0f66a0c).
(Reporter)

Updated

5 years ago
Whiteboard: js-triage-needed [jsbugmon:update,origRev=fff3dc9478ce,ignore] → js-triage-needed [jsbugmon:origRev=fff3dc9478ce,bisectfix]
(Reporter)

Updated

5 years ago
Whiteboard: js-triage-needed [jsbugmon:origRev=fff3dc9478ce,bisectfix] → js-triage-needed [jsbugmon:origRev=fff3dc9478ce]
(Reporter)

Comment 6

5 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   118493:f4671ccc4502
user:        Brian Hackett
date:        Thu Jan 10 17:53:11 2013 -0700
summary:     Bug 827490 - Allow native objects to have both slots and dense elements, rm dense/slow array distinction, r=billm, dvander.

This iteration took 118.894 seconds to run.
This assertion came back in the form of bug 829821 after bug 827490 landed, but the testcase seemed different enough to warrant a new bug.
(Reporter)

Comment 8

5 years ago
Created attachment 754434 [details]
[crash-signature] Machine-readable crash signature
(Assignee)

Updated

4 years ago
Assignee: general → nobody
Works fine nowadays, also with s/arguments/scriptArgs/
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.