Last Comment Bug 783989 - Assertion failure: isObject(), at ../../jsapi.h:474 or Opt Crash [@ global]
: Assertion failure: isObject(), at ../../jsapi.h:474 or Opt Crash [@ global]
Status: RESOLVED FIXED
[jsbugmon:update]
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla17
Assigned To: general
: general
:
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2012-08-20 04:29 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:34 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Return false after reporting error. v1 (1.21 KB, patch)
2012-08-20 10:46 PDT, Bobby Holley (:bholley) (busy with Stylo)
ejpbruel: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-08-20 04:29:08 PDT
The following test asserts/crashes on mozilla-central revision (no options required):


wrapWithProto(0);


This function seems debug only. Is this function in general safe to be used without having crashes to expect?
Comment 1 Christian Holler (:decoder) 2012-08-20 06:49:36 PDT
Forgot the revision, c676b554c7bb.
Comment 2 Bobby Holley (:bholley) (busy with Stylo) 2012-08-20 10:46:07 PDT
Created attachment 653435 [details] [diff] [review]
Return false after reporting error. v1

Silly bug. Flagging eddy for review.
Comment 3 Eddy Bruel [:ejpbruel] 2012-08-20 10:47:51 PDT
Comment on attachment 653435 [details] [diff] [review]
Return false after reporting error. v1

Review of attachment 653435 [details] [diff] [review]:
-----------------------------------------------------------------

I guess I should have caught this in my review of the original patch. Oh well. LGTM.
Comment 4 Bobby Holley (:bholley) (busy with Stylo) 2012-08-20 21:05:05 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/e81f71fda16f
Comment 5 Ed Morley [:emorley] 2012-08-21 06:27:50 PDT
https://hg.mozilla.org/mozilla-central/rev/e81f71fda16f
Comment 6 Christian Holler (:decoder) 2013-01-14 08:34:47 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug783989.js.

Note You need to log in before you can comment on or make changes to this bug.