Last Comment Bug 770407 - Assertion failure: JS_ObjectIsFunction(__null, this)
: Assertion failure: JS_ObjectIsFunction(__null, this)
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla16
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: 326633 761439
  Show dependency treegraph
 
Reported: 2012-07-02 20:30 PDT by Jesse Ruderman
Modified: 2013-01-14 08:41 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack trace (15.40 KB, text/plain)
2012-07-02 20:30 PDT, Jesse Ruderman
no flags Details
rm (1.33 KB, patch)
2012-07-03 15:29 PDT, Luke Wagner [:luke]
jwalden+bmo: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-07-02 20:30:14 PDT
Created attachment 638578 [details]
stack trace

var otherGlobal = newGlobal("same-compartment");
var proxy = otherGlobal.Proxy.create({}, {});
Int8Array.set(proxy);

Assertion failure: JS_ObjectIsFunction(__null, this), at js/src/jsfun.h:193

The first bad revision is:
changeset:   68c396f305f4
user:        Luke Wagner
date:        Wed Jun 20 08:57:29 2012 -0700
summary:     Bug 755186 - rm JS_NewGlobalObject (r=jorendorff)
Comment 1 Luke Wagner [:luke] 2012-07-02 21:05:04 PDT
The test-case repros before bug 755186 with s/same-compartment/new-compartment/.  (After bug 755186, all newGlobal() create a new compartment -- the argument is now ignored.)

Steve: I'm guessing this assert is innocuous, is that right?
Comment 2 Jesse Ruderman 2012-07-03 12:55:59 PDT
var otherGlobal = newGlobal("new-compartment");
var proxy = otherGlobal.Proxy.create({}, {});
Int8Array.set(proxy);

The first bad revision is:
changeset:   807490eb9bbd
user:        Luke Wagner
date:        Mon Jun 04 16:34:45 2012 -0700
summary:     Bug 761439 - Make IndirectProxyHandler::nativeCall indirect (r=sfink)
Comment 3 Luke Wagner [:luke] 2012-07-03 15:29:45 PDT
Created attachment 638888 [details] [diff] [review]
rm

The assert is overzealous.  I'm not sure if the property it is trying to ensure is even something we generally want anymore.  Waldo will actually be overhauling this area pretty soon.
Comment 5 Ryan VanderMeulen [:RyanVM] 2012-07-07 12:00:28 PDT
https://hg.mozilla.org/mozilla-central/rev/0da8cb3296fd
Comment 6 Christian Holler (:decoder) 2013-01-14 08:41:02 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug770407.js.

Note You need to log in before you can comment on or make changes to this bug.