328556 - Assertion failure: growth == (size_t)-1 || (nchars + 1) * sizeof(jschar) == growth, at js/src/jsarray.c:591

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Assertion failure: growth == (size_t)-1 || (nchars + 1) * sizeof(jschar) == growth, at /Users/admin/trunk/mozilla/js/src/jsarray.c:591

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

This is probably a regression from bug 311583.

Comment 3

[Igor Bukanov]

Attachment: Fix

This is indeed a regression caused by my changes for bug 311583 but it also exposes the problem with  MarkSharpObjects which enumerates over all properties while array_join_sub would go only over indexes. Thus js_EnterSharpObject would report about "#1=" prefix but which the regression did not account properly.

Comment 4

[Igor Bukanov]

That bad accounting that the patch from above fixes triggers the assert only when array_join_sub would not loop over any entries while MarkSharpObjects consider that there are cycles in the object graph. Moreover, it influences only the assert and nothing else.

I.e. it should not affect any build where assertions are turned off effectively removing the bug.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 213327 [details] [diff] [review]
Fix

r=mrbkap

Comment 6

[Igor Bukanov]

I filed bug 328745 about erroneous sharping in cases like from the above example.

Comment 7

[Igor Bukanov]

I committed the fix

Comment 8

[Bob Clary [:bc] (inactive)]

Checking in regress-328556.js;
/cvsroot/mozilla/js/tests/js1_5/Array/regress-328556.js,v  <--  regress-328556.js
initial revision: 1.1

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed trunk 20060328 win/mac/linux