Assertion failure: PCVCAP_MAKE(sprop->shape, 0, 0) == entry->vcap

VERIFIED FIXED in mozilla1.9beta4

Status

()

Core
JavaScript Engine
P1
major
VERIFIED FIXED
10 years ago
10 years ago

People

(Reporter: bc, Assigned: brendan)

Tracking

({assertion, crash})

Trunk
mozilla1.9beta4
assertion, crash
Points:
---
Bug Flags:
blocking1.9 +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(2 attachments)

(Reporter)

Description

10 years ago
Created attachment 306273 [details]
stack
Flags: blocking1.9?
Some notes, as I wish I'd rebuilt Spidermonkey with -g3:

Whenever I hit this with either test case, entry->vcap and entry->kshape and scope->shape are all in sync, but sprop->shape is 2 lower.  So entry->vword's sprop reference is out of date?

This is the function from the blog.163.com case that's tripping, haven't had a chance to extract from AOL yet:

function() {
    var batch = {
        map: {
            callCount: 0,
            page: window.location.pathname + window.location.search,
            httpSessionId: dwr.engine._getJSessionId(),
            scriptSessionId: dwr.engine._getScriptSessionId()
        },
        charsProcessed: 0,
        paramCount: 0,
        headers: [],
        parameters: [],
        isPoll: false,
        headers: {},
        handlers: {},
        preHooks: [],
        postHooks: [],
        rpcType: dwr.engine._rpcType,
        httpMethod: dwr.engine._httpMethod,
        async: dwr.engine._async,
        timeout: dwr.engine._timeout,
        errorHandler: dwr.engine._errorHandler,
        warningHandler: dwr.engine._warningHandler,
        textHtmlHandler: dwr.engine._textHtmlHandler
    };
    if (dwr.engine._preHook) batch.preHooks.push(dwr.engine._preHook);
    if (dwr.engine._postHook) batch.postHooks.push(dwr.engine._postHook);
    var propname,
    data;
    if (dwr.engine._headers) {
        for (propname in dwr.engine._headers) {
            data = dwr.engine._headers[propname];
            if (typeof data != "function") batch.headers[propname] = data;
        }
    }
    if (dwr.engine._parameters) {
        for (propname in dwr.engine._parameters) {
            data = dwr.engine._parameters[propname];
            if (typeof data != "function") batch.parameters[propname] = data;
        }
    }
    return batch;
}
(Assignee)

Comment 3

10 years ago
Created attachment 306589 [details] [diff] [review]
proposed fix

Shaver, thanks for the help -- can you test and r+? Thanks,

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #306589 - Flags: review?(shaver)
Comment on attachment 306589 [details] [diff] [review]
proposed fix

r=shaver

test fodder:

for (var i = 0; i < 2; i++)
    dict = {p: 1, q: 1, p:1};
Attachment #306589 - Flags: review?(shaver) → review+
(Assignee)

Updated

10 years ago
Flags: blocking1.9? → blocking1.9+
OS: Linux → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9beta4
(Assignee)

Comment 5

10 years ago
Comment on attachment 306589 [details] [diff] [review]
proposed fix

Would like to get this in ASAP.

/be
Attachment #306589 - Flags: approval1.9b4?
Attachment #306589 - Flags: approval1.9+
Comment on attachment 306589 [details] [diff] [review]
proposed fix

a1.9b4=beltzner
Attachment #306589 - Flags: approval1.9b4? → approval1.9b4+
(Assignee)

Comment 7

10 years ago
Fixed:

js/src/jsinterp.c 3.451

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
(Reporter)

Comment 8

10 years ago
/cvsroot/mozilla/js/tests/ecma_3/Regress/regress-420087.js,v  <--  regress-420087.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
(Reporter)

Comment 9

10 years ago
v 1.9.0
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.