Closed
Bug 873718
Opened 11 years ago
Closed 11 years ago
BaselineCompiler: Assertion failure: !JS_IsExceptionPending(cx), at shell/js.cpp
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla24
People
(Reporter: gkw, Assigned: Waldo)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:])
Attachments
(2 files, 1 obsolete file)
10.88 KB,
text/plain
|
Details | |
3.15 KB,
patch
|
till
:
review+
|
Details | Diff | Splinter Review |
x = Object.__proto__; Object.defineProperty(x, "prototype", { get: (function() { return function() { evaluate("", { newContext: true, })() } })(), }); this (void options('strict_mode')); asserts js debug shell on m-c changeset ecdfb8bb501e with --no-ti --ion-eager --no-jm at Assertion failure: !JS_IsExceptionPending(cx), at shell/js.cpp
Flags: needinfo?(kvijayan)
Flags: needinfo?(jdemooij)
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]
Comment 1•11 years ago
|
||
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Updated•11 years ago
|
Whiteboard: [jsbugmon:bisect] → [jsbugmon:]
Reporter | ||
Comment 2•11 years ago
|
||
Strange that autoBisect points to: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 130388:533d3fb8a7e9 user: Norbert Lindenberg date: Tue Apr 30 16:28:58 2013 -0400 summary: Bug 866305 - Enable ECMAScript Internationalization API for JavaScript standalone build. r=Waldo, r=glandium I'm not sure if this is correct. --enable-more-deterministic is needed to reproduce this bug.
Comment 3•11 years ago
|
||
Testcase below does not require an --enable-more-deterministic build. Looks like we're calling into JS under js_InitIntlClass, so autoBisect is probably correct. Forwarding needinfo? to Waldo. Object.defineProperty(Object.__proto__, "prototype", { get: function() { (function() { evaluate("print(3);", {newContext: true})(); })() } }); this.toSource();
Flags: needinfo?(jdemooij) → needinfo?(jwalden+bmo)
Assignee | ||
Comment 4•11 years ago
|
||
function Record() { return std_Object_create(null); } MakeConstructible(Record); |new Record()| evaluates |Record.prototype| to create the object returned by default if an object isn't explicitly returned. By the time Intl stuff is lazily evaluated, that's going to hit |Function.prototype.prototype| if it exists. Clear out the prototype so that we don't look up the prototype chain for |new|s. This is going to be a pervasive self-hosting concern for any sort of utility class, implemented in script, that's ever |new|'d. Record and List are the only such instances now, and List.prototype is already cleared out.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #752309 -
Flags: review?(tschneidereit)
Flags: needinfo?(jwalden+bmo)
Assignee | ||
Comment 5•11 years ago
|
||
It so happens that JSObject::defineProperty doesn't do a lookup (...which actually probably is sort of a bug, in some cases, for some arguments), so there's no second issue here, or the extra test here would have smoked it out.
Attachment #752309 -
Attachment is obsolete: true
Attachment #752309 -
Flags: review?(tschneidereit)
Attachment #752445 -
Flags: review?(tschneidereit)
Comment 6•11 years ago
|
||
Comment on attachment 752445 [details] [diff] [review] Slightly different tack, as discussed Review of attachment 752445 [details] [diff] [review]: ----------------------------------------------------------------- It's not pretty, but yes, absolutely. Thanks for doing this.
Attachment #752445 -
Flags: review?(tschneidereit) → review+
Reporter | ||
Updated•11 years ago
|
Flags: needinfo?(kvijayan)
Assignee | ||
Comment 7•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/091d40b0e948
OS: Mac OS X → All
Hardware: x86_64 → All
Target Milestone: --- → mozilla24
Comment 8•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/091d40b0e948
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•