Assertion failure: isObject(), at ../../jsapi.h:474 or Opt Crash [@ global]

RESOLVED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
mozilla17
x86_64
Linux
assertion, crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following test asserts/crashes on mozilla-central revision (no options required):


wrapWithProto(0);


This function seems debug only. Is this function in general safe to be used without having crashes to expect?
(Reporter)

Comment 1

5 years ago
Forgot the revision, c676b554c7bb.
Created attachment 653435 [details] [diff] [review]
Return false after reporting error. v1

Silly bug. Flagging eddy for review.
Attachment #653435 - Flags: review?(ejpbruel)
Comment on attachment 653435 [details] [diff] [review]
Return false after reporting error. v1

Review of attachment 653435 [details] [diff] [review]:
-----------------------------------------------------------------

I guess I should have caught this in my review of the original patch. Oh well. LGTM.
Attachment #653435 - Flags: review?(ejpbruel) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/e81f71fda16f

Comment 5

5 years ago
https://hg.mozilla.org/mozilla-central/rev/e81f71fda16f
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
(Reporter)

Comment 6

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug783989.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.