1506736 - Assertion failure: clasp->specDefined(), at js/xpconnect/wrappers/XrayWrapper.cpp:611

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Rob Wu [:robwu]]

I'm hitting a debug assertion failure when I follow the following steps:
1. Start a debug build of Firefox.
2. Visit about:debugging and select the checkbox to ensure that Chrome debugging is enabled.
3. Open the global JS console (Ctrl-Shift-J)
4. Enter the following snippet (more info at the end):

   Cu.Sandbox(null).Number.xxx

5. Press Enter to run it.

Expected result:
- undefined (=value of property xxx of Number; xxx could be anything, it doesn't matter)

Actual result:
- Assertion failure: clasp->specDefined(), at js/xpconnect/wrappers/XrayWrapper.cpp:611
#01: xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::PropertyDescriptor>) const (js/xpconnect/wrappers/XrayWrapper.cpp:2119)
#02: js::BaseProxyHandler::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool*) const (js/src/proxy/BaseProxyHandler.cpp:92)
#03: js::Proxy::getInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (js/src/proxy/Proxy.cpp:369)


Links to sources:
[0]: https://searchfox.org/mozilla-central/rev/06d5d5ae4396be85f26e8548323ee6c12e7bce4e/js/xpconnect/wrappers/XrayWrapper.cpp#611
[1]: https://searchfox.org/mozilla-central/rev/06d5d5ae4396be85f26e8548323ee6c12e7bce4e/js/xpconnect/wrappers/XrayWrapper.cpp#2008
[2]: https://searchfox.org/mozilla-central/rev/7f7c353e969e61a6a85201cc8ad3c3de12ac30d8/js/src/proxy/BaseProxyHandler.cpp#92
[3]: https://searchfox.org/mozilla-central/rev/7f7c353e969e61a6a85201cc8ad3c3de12ac30d8/js/src/proxy/Proxy.cpp#369


clasp has the JSProto_Number type at the assertion failure.
I found the type listed at [66] along with other types.
The assertion passes when I use one of the types with InitViaClassSpec (e.g. Array, Object, RegExp, Date, Promise, Uint8Array, ...) or JSON, Math, Reflect or Intl.
The assertion fails when I use: Boolean, Number, String, Proxy, WeakMap, Symbol, WeakSet. 


[66]: https://searchfox.org/mozilla-central/rev/7f7c353e969e61a6a85201cc8ad3c3de12ac30d8/js/public/ProtoKey.h#66

Comment 1

[Rob Wu [:robwu]]

Based on the stack, I think that bug 1304918 could originally have been caused by this bug.

I can see that the spec is indeed unset for the types at the end of comment #0.
Though I'm not sure what should be done here.

The assertion was introduced in bug 1243824 - https://searchfox.org/mozilla-central/diff/5289b5b26f910a100dea64c0448271a7f1eaaa4c/js/xpconnect/wrappers/XrayWrapper.cpp#869

Bobby, why is this assertion here? What should be done here?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Xrayable classes are expected to have a ClassSpec.  That's what that assertion is trying to assert.

That said, Number is not Xrayable.  Presumably ShouldResolveStaticProperties should only return true if IsJSXraySupported() for the relevant protokey...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Bug 1506736. Don't try to Xray statics on JS builtin constructors that we don't normally support Xrays for. r=bholley

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c64e836cd9ef
Don't try to Xray statics on JS builtin constructors that we don't normally support Xrays for.   r=bholley

Comment 5

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/c64e836cd9ef