245503 - setTimeout call fired and crashed when js_GetAtom returned its static dummy atom

Status: RESOLVED INACTIVE

(Core :: DOM: Core & HTML, defect)

Description

[timeless]

-	(JSAtom *)id	0x0100d610 dummy	JSAtom *
-	entry	{next=0x00000000 {next=??? keyHash=??? key=??? ...} 
keyHash=0x00000000 key=0x00000000 ...}	JSHashEntry
+	next	0x00000000 {next=??? keyHash=??? key=??? ...}	JSHashEn7try *
	keyHash	0x00000000	unsigned long
	key	0x00000000	const void *
	value	0x00000000	void *
	flags	0x00000000	unsigned long
	number	0x00000000	unsigned long

I've hit the assertion referenced here before, but i can't find a bug report 
for it.

anyway this is using our internal build box, a tree from the 1.7 branch (i 
believe it's 1.7b

 	js3250.dll!js_LookupProperty(JSContext * cx=0x03145f98, JSObject * 
obj=0x02db08a0, long id=0x0100d610, JSObject * * objp=0x0012f78c, JSProperty * 
* propp=0x0012f790)  Line 2343 + 0x18	C
 	js3250.dll!js_FindProperty(JSContext * cx=0x03145f98, long 
id=0x0100d610, JSObject * * objp=0x0012f8f8, JSObject * * pobjp=0x0012f898, 
JSProperty * * propp=0x0012f894)  Line 2519 + 0x15	C
 	js3250.dll!js_Interpret(JSContext * cx=0x7c3416b8, long * 
result=0x027db110)  Line 3021 + 0x1b	C
 	js3250.dll!js_Invoke(JSContext * cx=0x00000000, unsigned int 
argc=0x7c3416b8, unsigned int flags=0x027db110)  Line 958 + 0xa	C
 	js3250.dll!js_Interpret(JSContext * cx=0x7c3416b8, long * 
result=0x027db110)  Line 2964	C
 	js3250.dll!js_Execute(JSContext * cx=0x02ea9c28, JSObject * 
chain=0x02ea9c28, JSScript * script=0x02d91738, JSStackFrame * down=0x00000000, 
unsigned int special=0x00000000, long * result=0x0012fbf0)  Line 1157	C
>	js3250.dll!JS_EvaluateUCScriptForPrincipals(JSContext * cx=0x03145f98, 
JSObject * obj=0x02ea9c28, JSPrincipals * principals=0x00e3ef34, const unsigned 
short * chars=0x0303cf58, unsigned int length=0x00000016, const char * 
filename=0x0333ca30, unsigned int lineno=0x000000f5, long * rval=0x0012fbf0)  
Line 3541 + 0xf	C
+	aScript	{mVTable=0x100424c8 const nsObsoleteAStringThunk::`vftable' 
mData=0x0303cf58 "performTraversalStep()" mLength=0x00000016 ...}	const 
nsAString &
 	gklayout.dll!nsJSContext::EvaluateString(const nsAString & aScript=
{...}, void * aScopeObject=0x02ea9c28, nsIPrincipal * aPrincipal=0x00e3ef30, 
const char * aURL=0x0333ca30, unsigned int aLineNo=0x000000f5, const char * 
aVersion=0x0100112c, nsAString & aRetValue={...}, int * 
aIsUndefined=0x0012fd3c)  Line 946 + 0x35	C++
 	gklayout.dll!GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 
aTimeout=0x027db110)  Line 5143 + 0x39	C++
 	gklayout.dll!GlobalWindowImpl::TimerCallback(nsITimer * 
aTimer=0x031e9ff0, void * aClosure=0x02e77778)  Line 5520	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 382 + 0x7	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 616	C++
 	gkwidget.dll!nsAppShell::Run()  Line 142	C++
 	appshell.dll!nsAppShellService::Run()  Line 524	C++
 	mozilla.exe!main1(int argc=0x7c3416b8, char * * argv=0x027db110, 
nsISupports * nativeApp=0x0012f78c)  Line 1303 + 0x9	C++
 	mozilla.exe!main(int argc=0x00000003, char * * argv=0x002a4c18)  Line 
1777 + 0x16	C++
 	mozilla.exe!WinMain(HINSTANCE__ * __formal=0x00400000, HINSTANCE__ * 
__formal=0x00400000, char * args=0x0015231c, HINSTANCE__ * 
__formal=0x00400000)  Line 1805 + 0x17	C++
 	mozilla.exe!WinMainCRTStartup()  Line 390 + 0x1b	C
 	kernel32.dll!GetCurrentDirectoryW()  + 0x44