Last Comment Bug 382503 - "Assertion failure: (slot) < (uint32)(obj)->dslots[-1]" with prototype=regexp
: "Assertion failure: (slot) < (uint32)(obj)->dslots[-1]" with prototype=regexp
Status: VERIFIED FIXED
[sg:critical?] fixed by bug 382532
: assertion, fixed1.8.0.13, testcase, verified1.8.1.5
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on: 382532
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2007-05-30 14:10 PDT by Jesse Ruderman
Modified: 2007-12-03 14:38 PST (History)
8 users (show)
jruderman: blocking1.9?
dveditz: blocking1.8.1.5+
dveditz: wanted1.8.1.x+
dveditz: wanted1.8.0.x+
bob: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
js1_5/Object/regress-382503.js (2.19 KB, text/plain)
2007-06-15 12:25 PDT, Bob Clary [:bc:]
no flags Details

Description Jesse Ruderman 2007-05-30 14:10:20 PDT
function f(x)
{
  prototype = /a/;

  if (x) {
    return /b/;
    return /c/;
  } else {
    return /d/;
  }
}

void f(false);


Triggers:
Assertion failure: (slot) < (uint32)(obj)->dslots[-1], at jsobj.c:4990

0   JS_Assert
1   js_SetRequiredSlot + 380 (jsobj.c:4990)
2   JS_SetReservedSlot + 188 (jsapi.c:4013)
3   js_Interpret + 66856 (jsinterp.c:4266)
4   js_Execute + 715 (jsinterp.c:1591)
5   JS_ExecuteScript + 54 (jsapi.c:4693)
6   Process + 912 (js.c:268)
7   ProcessArgs + 2045 (js.c:519)
8   main + 612 (js.c:3271)
9   _start + 216
10  start + 41
Comment 1 Jesse Ruderman 2007-06-01 00:16:49 PDT
Is this a memory safety bug?
Comment 2 Blake Kaplan (:mrbkap) 2007-06-01 00:26:44 PDT
Yeah, you'd probably get heap corruption in opt builds.
Comment 3 Jesse Ruderman 2007-06-11 16:14:28 PDT
WFM.  mrbkap says this was fixed (and fixed properly) by bug 382532.
Comment 4 Bob Clary [:bc:] 2007-06-15 12:25:56 PDT
Created attachment 268522 [details]
js1_5/Object/regress-382503.js
Comment 5 Jay Patel [:jay] 2007-07-10 15:00:47 PDT
Marking fixed1.8.1.5 per bug 382532 landing.
Comment 6 Bob Clary [:bc:] 2007-07-17 10:56:43 PDT
verified fixed 1.8.1, 1.9.0 windows/linux/macppc opt/debug browser/shell 7/16
Comment 7 Bob Clary [:bc:] 2007-09-21 07:30:36 PDT
/cvsroot/mozilla/js/tests/js1_5/Object/regress-382503.js,v  <--  regress-382503.js
initial revision: 1.1
Comment 8 Daniel Veditz [:dveditz] 2007-12-03 14:38:13 PST
bug 382532 was fixed on both 1.8 branches

Note You need to log in before you can comment on or make changes to this bug.