Crash [@ js_SetCallVariable] or "Assertion failure: prop, at jsfun.c:1046"

VERIFIED FIXED in mozilla1.9alpha1

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
11 years ago
a year ago

People

(Reporter: Jesse Ruderman, Assigned: mrbkap)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.9alpha1
crash, testcase, verified1.8.0.2, verified1.8.1
Points:
---
Bug Flags:
blocking1.8.0.2 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [rft-dl], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

11 years ago
Steps to reproduce:
  1. Make sure the testcase is allowed to open popup windows (to force GC).
  2. Load the testcase.

Result:
  Mac debug: Always aborts with "Assertion failure: prop, at jsfun.c:1046"
  Mac nightly: Sometimes crashes [@ js_SetCallVariable].
  
Expected:
  No crash or assertion failure.

I spent many hours trying to create a reduced testcase for this crash.  I hope it's useful.
(Reporter)

Comment 1

11 years ago
Created attachment 212200 [details]
testcase
(Assignee)

Updated

11 years ago
OS: MacOS X → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.9alpha
(Assignee)

Comment 2

11 years ago
Created attachment 212284 [details] [diff] [review]
Proposed fix

We can't assume that we're going to find the prototype property -- we'd normally find it on the proto chain, but that's been severed!
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #212284 - Flags: review?(brendan)
Comment on attachment 212284 [details] [diff] [review]
Proposed fix

No-brainer for branches.

/be
Attachment #212284 - Flags: review?(brendan)
Attachment #212284 - Flags: review+
Attachment #212284 - Flags: approval1.8.0.2+
Attachment #212284 - Flags: approval-branch-1.8.1+
(Assignee)

Comment 4

11 years ago
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Flags: blocking1.8.1?
Flags: blocking1.8.0.2?
Resolution: --- → FIXED
(Reporter)

Comment 5

11 years ago
Verified fixed using today's Mac nightly.
Status: RESOLVED → VERIFIED
Flags: blocking1.8.0.2? → blocking1.8.0.2+
(Assignee)

Comment 6

11 years ago
Fix checked into the 1.8 branches.
Keywords: fixed1.8.0.2, fixed1.8.1

Comment 7

11 years ago
Checking in regress-327608.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-327608.js,v  <--  regress-327608.js
initial revision: 1.1
done
Flags: testcase+
Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates) since in-testsuite+ indicates a test case exists in the js test library.
Whiteboard: [rft-dl]

Comment 9

11 years ago
v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac
Keywords: fixed1.8.0.2, fixed1.8.1 → verified1.8.0.2, verified1.8.1
Crash Signature: [@ js_SetCallVariable]
(Assignee)

Updated

a year ago
Flags: blocking1.8.1?
You need to log in before you can comment on or make changes to this bug.