418139 - "Assertion failure: protoIndex != 1 || OBJ_GET_PROTO(cx, obj) == pobj" with <svg:use>, <xul:listbox>, CSS

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (triggers a fatal assertion when loaded)

Assertion failure: protoIndex != 1 || OBJ_GET_PROTO(cx, obj) == pobj, at /Users/jruderman/trunk/mozilla/js/src/jsinterp.c:223

The testcase consists of SVG, XUL, and CSS.  Strange to see that combination triggering an assertion in the JavaScript engine.

The assertion is part of code added in bug 365851 "return of the property cache".

Nightly builds don't explode.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jesse Ruderman]

I'm hitting this assertion very frequently when fuzzing.

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Can you see what protoIndex is, and what the prototype relationship is between obj and pobj when you trip this assertion?

Comment 4

[Jesse Ruderman]

(gdb) p protoIndex
$1 = 1
(gdb) p pobj
$2 = (JSObject *) 0x3d1861e0
(gdb) p obj
$3 = (JSObject *) 0x3d186900
(gdb) p/x obj->fslots[0]
$5 = 0x3d1871e0
(gdb) p/x obj->fslots[1]
$6 = 0x3d1868e0
(gdb) p/x obj->fslots[2]
$7 = 0x3ba509a5
(gdb) p/x obj->fslots[3]
$8 = 0x3d2a20e1

(Can't you reproduce this yourself using the testcase?)

Comment 6

[Brendan Eich [:brendan]]

Attachment: fix, passes js and mochi tests

Comment 7

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 306800 [details] [diff] [review]
fix, passes js and mochi tests

r+a=shaver.  I wish we could prohibit late JS_SetParent programmatically, but I can't think of how we would.

Jesse: can you see how to turn the assertion-triggering example into mochi-fodder?

Comment 8

[Jesse Ruderman]

I'd just check in the testcase as a crashtest, unless Brendan knows how to test this bug more directly.

Comment 9

[Brendan Eich [:brendan]]

Shapes are capabilities, so there's no correctness bug if someone changes the scope chain from a getter or setter, so as to invalidate the fill that follows soon after the getter or setter returns.

Fixed:

js/src/jsinterp.c 3.457

Crashtest sounds good. I'll think about better ways to test.

/be

Comment 10

[Jesse Ruderman]

Should I create js/tests/crashtests/ or js/src/crashtests/?

Comment 11

[Jeff Walden [:Waldo]]

Neither's great; js/ should really be its own world (sadly modulo js/src/xpconnect, which I wish were outside the js/ directory) in my opinion.  Maybe dump it in js/src/xpconnect/crashtests?

Comment 12

[Jesse Ruderman]

Crashtest checked in using waldo's suggested location.

Comment 13

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5pre) Gecko/2008032615 Firefox/3.0b5pre ID:2008032615 - no assertion on the testcase 

--> Verified