Bug 28340 – 64-bit: ASSERTION FAILED: Objects passed to JSInspectedObjectWrapper must be wrapped

• Component: Tools / Tests
• Status: RESOLVED FIXED

[Simon Fraser (smfr)]

Created attachment 34902 [details]
Testcase

I get that assertion with the attached testcase, when the inspector is open.

[Simon Fraser (smfr)]

This is preventing me from getting work done.

[Sam Weinig]

Simon, do you know when this regressed?

[Simon Fraser (smfr)]

I think I first saw it on Saturday.

[Pavel Feldman]

I is likely to be caused by the DOMAgent migration in the WebInspector. Will fix it shortly.

[Pavel Feldman]

The assertion reported is clearly WebInspector's fault, but I can't repro it on ToT. It behaves exactly as in Safari 4.0.2. Here is what I do:

1. Open sample attached
2. Open WebInspector
3. Refresh the page

I see 6 entries in the console:
1. > [CSSValue] transition-test-helpers.js:72
2. TypeError: Result of expression 'computedStyle[i].getFloatValue' [undefined] is not a function. transition-test-helpers.js:73
3. > [CSSValue] transition-test-helpers.js:72
4. TypeError: Result of expression 'computedStyle[i].getFloatValue' [undefined] is not a function. transition-test-helpers.js:73
5. > [CSSValue] transition-test-helpers.js:72
6. TypeError: Result of expression 'computedStyle[i].getFloatValue' [undefined] is not a function. transition-test-helpers.js:73

The reason of errors is that the style value is instanceof CSSValue, not CSPrimitiveValue. If I put a check there before calling, I am getting the test PASSED.

Are you sure we are not talking about some local modifications you have? They could uncover the bug.

[Simon Fraser (smfr)]

Created attachment 35019 [details]
Simpler testcase

[Oliver Hunt]

An even simpler way to repro:
1. open the console
2. Math.sin

assertion failure

[Pavel Feldman]

Both scenarios work fine on 32-bit and on Chromium 64-bit. Latter uses another version of DOM bindings including different quarantine code though. So most likely the problem is with the JSC quarantines.

I don't feel comfortable owning this bug since I can't reproduce it in the standard WebKit environment. Note that I am working on removing quarantines from the Web Inspector at all, so that the bug might become obsolete some time soon.

[Simon Fraser (smfr)]

We need to figure out when this regressed.

[Pavel Feldman]

(In reply to comment #9)
> We need to figure out when this regressed.

It is known when it regressed (my Migrate to DOMAgent change), but it is unclear why it is only triggering on 64bit. I can't reproduce it, but I know that it is triggering in the console formatting code. I hope Oliver finishes his analysis and points me to the statement in the javascript code triggering the assertion.

[Pavel Feldman]

Created attachment 38477 [details]
MiniBrowser 64-bit

[Pavel Feldman]

(In reply to comment #11)
> Created an attachment (id=38477) [details]
> MiniBrowser 64-bit

I see no problems running MiniBrowser 64-bit. All test cases behave as in Safari 4, I see no assertions triggered. See screenshot attached.

[Simon Fraser (smfr)]

I can no longer reproduce the issue.