1072677 - Assertion failure: JSID_IS_STRING(iden), at dist/include/js/Id.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Array.prototype.push.call(this, WeakMap);
f();

asserts js debug shell on m-i changeset e6e63113336d with --no-threads --no-ion at Assertion failure: JSID_IS_STRING(iden), at dist/include/js/Id.h.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-inbound/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/1049cfbf3426
user:        Nick Fitzgerald
date:        Tue Sep 23 16:34:00 2014 +0200
summary:     Bug 947044 - Provide a suggestion when throwing ReferenceError: <name> is not defined. r=luke

Nick, is bug 947044 a possible regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0xcfb19, 0x000000010046e68c js-dbg-opt-64-dm-nsprBuild-darwin-e6e63113336d`js_ReportIsNotDefined(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSAtom*>) [inlined] JS::AutoGCRooter::AutoGCRooter(this=0x0000000000000000, cx=<unavailable>, cx=<unavailable>, tag=<unavailable>) + 28 at jsapi.cpp:6453, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x000000010046e68c js-dbg-opt-64-dm-nsprBuild-darwin-e6e63113336d`js_ReportIsNotDefined(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSAtom*>) [inlined] JS::AutoGCRooter::AutoGCRooter(this=0x0000000000000000, cx=<unavailable>, cx=<unavailable>, tag=<unavailable>) + 28 at jsapi.cpp:6453
    frame #1: 0x000000010046e670 js-dbg-opt-64-dm-nsprBuild-darwin-e6e63113336d`js_ReportIsNotDefined(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSAtom*>) [inlined] JS::AutoVectorRooter<jsid>::AutoVectorRooter(cx=<unavailable>, tag=<unavailable>) at jsapi.h:122
    frame #2: 0x000000010046e670 js-dbg-opt-64-dm-nsprBuild-darwin-e6e63113336d`js_ReportIsNotDefined(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSAtom*>) [inlined] JS::AutoIdVector::AutoIdVector(cx=<unavailable>) at jsapi.h:460
    frame #3: 0x000000010046e670 js-dbg-opt-64-dm-nsprBuild-darwin-e6e63113336d`js_ReportIsNotDefined(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSAtom*>) [inlined] JS::AutoIdVector::AutoIdVector(cx=<unavailable>) at jsapi.h:462
    frame #4: 0x000000010046e670 js-dbg-opt-64-dm-nsprBuild-darwin-e6e63113336d`js_ReportIsNotDefined(cx=<unavailable>, pc=<unavailable>, script=<unavailable>, atom=<unavailable>) + 3264 at jscntxt.cpp:988

Comment 2

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

Yeah this looks like bug 947044, which I'm backing out now.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9e3d649b80a2).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Nick Fitzgerald [:fitzgen] from comment #2)
> Yeah this looks like bug 947044, which I'm backing out now.

Marking FIXED by backout of bug 947044.