Assertion failure: JS_ObjectIsFunction(__null, this)

RESOLVED FIXED in mozilla16

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla16
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 638578 [details]
stack trace

var otherGlobal = newGlobal("same-compartment");
var proxy = otherGlobal.Proxy.create({}, {});
Int8Array.set(proxy);

Assertion failure: JS_ObjectIsFunction(__null, this), at js/src/jsfun.h:193

The first bad revision is:
changeset:   68c396f305f4
user:        Luke Wagner
date:        Wed Jun 20 08:57:29 2012 -0700
summary:     Bug 755186 - rm JS_NewGlobalObject (r=jorendorff)
(Assignee)

Comment 1

5 years ago
The test-case repros before bug 755186 with s/same-compartment/new-compartment/.  (After bug 755186, all newGlobal() create a new compartment -- the argument is now ignored.)

Steve: I'm guessing this assert is innocuous, is that right?
No longer blocks: 755186
(Reporter)

Comment 2

5 years ago
var otherGlobal = newGlobal("new-compartment");
var proxy = otherGlobal.Proxy.create({}, {});
Int8Array.set(proxy);

The first bad revision is:
changeset:   807490eb9bbd
user:        Luke Wagner
date:        Mon Jun 04 16:34:45 2012 -0700
summary:     Bug 761439 - Make IndirectProxyHandler::nativeCall indirect (r=sfink)
Blocks: 761439
(Assignee)

Comment 3

5 years ago
Created attachment 638888 [details] [diff] [review]
rm

The assert is overzealous.  I'm not sure if the property it is trying to ensure is even something we generally want anymore.  Waldo will actually be overhauling this area pretty soon.
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #638888 - Flags: review?(jwalden+bmo)
Attachment #638888 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Comment 4

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/0da8cb3296fd
Target Milestone: --- → mozilla16
https://hg.mozilla.org/mozilla-central/rev/0da8cb3296fd
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug770407.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.