Closed Bug 827082 Opened 7 years ago Closed 7 years ago

IonMonkey: "Assertion failure: target->isNativeConstructor(),"

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla20

People

(Reporter: gkw, Assigned: h4writer)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker][jsbugmon:update])

Attachments

(2 files)

Attached file stack
new [].sort()

asserts js debug shell on m-c changeset 20d1a5916ef6 with -ion-eager at Assertion failure: target->isNativeConstructor(),

This is flooding the fuzzer boxes, setting [fuzzblocker].

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   117618:67e44e98555c
user:        Hannes Verschore
date:        Fri Jan 04 17:11:32 2013 +0100
summary:     Bug 825705: Creating this on caller-side shouldn't query prototype for unknown objects, r=jandem
Flags: needinfo?(hv1989)
Attached patch FixSplinter Review
Something went wrong when copying that code and in this case "CreateThis" should return NULL instead of asserting. This patch should fix it. Trivial patch, but nobody is online to get a quick r+
Assignee: general → hv1989
Attachment #698411 - Flags: review?(jdemooij)
Flags: needinfo?(hv1989)
Comment on attachment 698411 [details] [diff] [review]
Fix

We should never call a native non-constructor function with new. This should always result in an error. So returning NULL seems fine.
Attachment #698411 - Flags: review?(jdemooij) → review?(evilpies)
Attachment #698411 - Flags: review?(evilpies) → review+
Flags: in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/9968445e5343
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.