1182092 - Assertion failure: !isIndex(&dummy), at c:\users\mozilla\debug-builds\mozilla-central\js\src\vm/String.h:1409

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter stack

found via bughunter  and reproduced on windows 7 trunk debug build

For the url please ask me 

--> Assertion failure: !isIndex(&dummy), at c:\users\mozilla\debug-builds\mozilla-central\js\src\vm/String.h:1409

Comment 1

[Carsten Book [:Tomcat]]

Attachment: windbg Exception Analysis *

Comment 3

[Jan de Mooij [:jandem]]

This seems related to unboxed objects.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

I can't get the page to load, but this should fix the assertion.  newPlainObject() tries to filter out objects that have strings which are indexes, by checking IdIsIndex on each property in objects it creates.  You might think this would be enough to catch index properties, but IdIsIndex actually calls StringIsArrayIndex, which does something totally different.

Comment 5

[Brian Hackett [Laid off!]]

This assertion failure shouldn't lead to any bad behavior.

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/40227d8273cc

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/40227d8273cc