Last Comment Bug 327608 - Crash [@ js_SetCallVariable] or "Assertion failure: prop, at jsfun.c:1046"
: Crash [@ js_SetCallVariable] or "Assertion failure: prop, at jsfun.c:1046"
Status: VERIFIED FIXED
[rft-dl]
: crash, testcase, verified1.8.0.2, verified1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: P1 critical (vote)
: mozilla1.9alpha1
Assigned To: Blake Kaplan (:mrbkap)
:
Mentors:
Depends on:
Blocks: 326633
  Show dependency treegraph
 
Reported: 2006-02-17 01:33 PST by Jesse Ruderman
Modified: 2016-05-11 15:45 PDT (History)
3 users (show)
dveditz: blocking1.8.0.2+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (419 bytes, text/html)
2006-02-17 01:34 PST, Jesse Ruderman
no flags Details
Proposed fix (963 bytes, patch)
2006-02-17 18:48 PST, Blake Kaplan (:mrbkap)
brendan: review+
brendan: approval‑branch‑1.8.1+
brendan: approval1.8.0.2+
Details | Diff | Splinter Review

Description Jesse Ruderman 2006-02-17 01:33:13 PST
Steps to reproduce:
  1. Make sure the testcase is allowed to open popup windows (to force GC).
  2. Load the testcase.

Result:
  Mac debug: Always aborts with "Assertion failure: prop, at jsfun.c:1046"
  Mac nightly: Sometimes crashes [@ js_SetCallVariable].
  
Expected:
  No crash or assertion failure.

I spent many hours trying to create a reduced testcase for this crash.  I hope it's useful.
Comment 1 Jesse Ruderman 2006-02-17 01:34:13 PST
Created attachment 212200 [details]
testcase
Comment 2 Blake Kaplan (:mrbkap) 2006-02-17 18:48:29 PST
Created attachment 212284 [details] [diff] [review]
Proposed fix

We can't assume that we're going to find the prototype property -- we'd normally find it on the proto chain, but that's been severed!
Comment 3 Brendan Eich [:brendan] 2006-02-17 18:55:43 PST
Comment on attachment 212284 [details] [diff] [review]
Proposed fix

No-brainer for branches.

/be
Comment 4 Blake Kaplan (:mrbkap) 2006-02-17 19:03:01 PST
Fix checked into trunk.
Comment 5 Jesse Ruderman 2006-02-18 18:56:12 PST
Verified fixed using today's Mac nightly.
Comment 6 Blake Kaplan (:mrbkap) 2006-02-22 12:53:51 PST
Fix checked into the 1.8 branches.
Comment 7 Bob Clary [:bc:] 2006-02-26 00:01:11 PST
Checking in regress-327608.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-327608.js,v  <--  regress-327608.js
initial revision: 1.1
done
Comment 8 Dave Liebreich [:davel] 2006-03-01 14:04:09 PST
Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates) since in-testsuite+ indicates a test case exists in the js test library.
Comment 9 Bob Clary [:bc:] 2006-03-02 12:08:17 PST
v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac

Note You need to log in before you can comment on or make changes to this bug.