827082 - IonMonkey: "Assertion failure: target->isNativeConstructor(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

new [].sort()

asserts js debug shell on m-c changeset 20d1a5916ef6 with -ion-eager at Assertion failure: target->isNativeConstructor(),

This is flooding the fuzzer boxes, setting [fuzzblocker].

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   117618:67e44e98555c
user:        Hannes Verschore
date:        Fri Jan 04 17:11:32 2013 +0100
summary:     Bug 825705: Creating this on caller-side shouldn't query prototype for unknown objects, r=jandem

Comment 1

[Hannes Verschore [:h4writer]]

Attachment: Fix

Something went wrong when copying that code and in this case "CreateThis" should return NULL instead of asserting. This patch should fix it. Trivial patch, but nobody is online to get a quick r+

Comment 2

[Tom S [:evilpie]]

Comment on attachment 698411 [details] [diff] [review]
Fix

We should never call a native non-constructor function with new. This should always result in an error. So returning NULL seems fine.

Comment 3

[Hannes Verschore [:h4writer]]

Thanks Tom :D.
https://hg.mozilla.org/integration/mozilla-inbound/rev/9968445e534

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/9968445e5343

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.