898695 - Crash [@ JS_GetClass] or [@ js::CallJSNative] or [@ GetClass] or Assertion failure: thisObj, at builtin/BinaryData.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

[0].map(ArrayType.prototype.toString, null)

asserts js debug shell on m-c changeset 5aa02ee02f4b without any CLI arguments at Assertion failure: thisObj, at builtin/BinaryData.cpp

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8253f5b39cbd
user:        Nikhil Marathe
date:        Thu Jul 25 17:59:14 2013 -0700
summary:     Bug 578700 - ArrayType and BinaryArray implementation. r=nmatsakis

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt stack

This also crashes opt shell at JS_GetClass with js::CallJSNative on the stack. This can also manifest as crashes at GetClass.

Comment 3

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Fixed by patch for 898622

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b8c7acba4b40).

Comment 5

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Leaving open to test after 898661 is undone

Comment 6

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Bug 898347 enabled Binary Data a while ago. Marking as fixed.

Comment 7

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Bug 898347 enabled Binary Data a while ago. Marking as fixed.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

JSBugMon can verify this.