595612 - "Assertion failure: ((Shape*)prop)->slot == globalScope.globalFreeSlot + i"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (triggers fatal assertion when loaded)

Assertion failure: ((Shape*)prop)->slot == globalScope.globalFreeSlot + i, at js/src/jsparse.cpp:982

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jesse Ruderman]

This breaks my DOM fuzzer pretty badly.

Comment 3

[ojab]

Also happens on x86_64 linux, but attached testcase doesn't trigger it.

Comment 4

[ojab]

Attachment: gdb bt

Comment 5

[ojab]

Attachment: gdb bt full

Comment 6

[Phil Ringnalda (:philor)]

Possible alternate way to reproduce: run the mochitest test_bug347174_xsl.html in a loop until it triggers.

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1284628613.1284629926.10397.gz
Rev3 Fedora 12 mozilla-central debug test mochitests-1/5 on 2010/09/16 02:16:53
s: talos-r3-fed-009

38160 INFO TEST-START | /tests/content/html/content/test/test_bug347174_xsl.html
...
Assertion failure: ((Shape*)prop)->slot == globalScope.globalFreeSlot + i, at /builds/slave/mozilla-central-linux-debug/build/js/src/jsparse.cpp:1008

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I get this assertion reproducibly if I reload http://www.pcmag.com/article2/0,2817,2369280,00.asp several times.

Comment 8

[ojab]

100% crash on jira installations, http://tickets.2600hz.org/ for example.

Comment 9

[David Anderson [:dvander] - inactive, e-mail if emergency]

I can't reproduce this, but it would be caused by the parser adding properties to the global object. Whatever is causing *that*, it will be fixed with bug 595917 which also removes the assert.