770407 - Assertion failure: JS_ObjectIsFunction(__null, this)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack trace

var otherGlobal = newGlobal("same-compartment");
var proxy = otherGlobal.Proxy.create({}, {});
Int8Array.set(proxy);

Assertion failure: JS_ObjectIsFunction(__null, this), at js/src/jsfun.h:193

The first bad revision is:
changeset:   68c396f305f4
user:        Luke Wagner
date:        Wed Jun 20 08:57:29 2012 -0700
summary:     Bug 755186 - rm JS_NewGlobalObject (r=jorendorff)

Comment 1

[Luke Wagner [:luke]]

The test-case repros before bug 755186 with s/same-compartment/new-compartment/.  (After bug 755186, all newGlobal() create a new compartment -- the argument is now ignored.)

Steve: I'm guessing this assert is innocuous, is that right?

Comment 2

[Jesse Ruderman]

var otherGlobal = newGlobal("new-compartment");
var proxy = otherGlobal.Proxy.create({}, {});
Int8Array.set(proxy);

The first bad revision is:
changeset:   807490eb9bbd
user:        Luke Wagner
date:        Mon Jun 04 16:34:45 2012 -0700
summary:     Bug 761439 - Make IndirectProxyHandler::nativeCall indirect (r=sfink)

Comment 3

[Luke Wagner [:luke]]

Attachment: rm

The assert is overzealous.  I'm not sure if the property it is trying to ensure is even something we generally want anymore.  Waldo will actually be overhauling this area pretty soon.

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0da8cb3296fd

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0da8cb3296fd

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug770407.js.