327608 - Crash [@ js_SetCallVariable] or "Assertion failure: prop, at jsfun.c:1046"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Steps to reproduce:
  1. Make sure the testcase is allowed to open popup windows (to force GC).
  2. Load the testcase.

Result:
  Mac debug: Always aborts with "Assertion failure: prop, at jsfun.c:1046"
  Mac nightly: Sometimes crashes [@ js_SetCallVariable].
  
Expected:
  No crash or assertion failure.

I spent many hours trying to create a reduced testcase for this crash.  I hope it's useful.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

We can't assume that we're going to find the prototype property -- we'd normally find it on the proto chain, but that's been severed!

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 212284 [details] [diff] [review]
Proposed fix

No-brainer for branches.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 5

[Jesse Ruderman]

Verified fixed using today's Mac nightly.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branches.

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in regress-327608.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-327608.js,v  <--  regress-327608.js
initial revision: 1.1
done

Comment 8

[Dave Liebreich [:davel]]

Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates) since in-testsuite+ indicates a test case exists in the js test library.

Comment 9

[Bob Clary [:bc] (inactive)]

v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac