420087 - Assertion failure: PCVCAP_MAKE(sprop->shape, 0, 0) == entry->vcap

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

Attachment: stack

Comment 1

[Bob Clary [:bc] (inactive)]

ditto <http://blog.163.com/?fromNavigation>

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Some notes, as I wish I'd rebuilt Spidermonkey with -g3:

Whenever I hit this with either test case, entry->vcap and entry->kshape and scope->shape are all in sync, but sprop->shape is 2 lower.  So entry->vword's sprop reference is out of date?

This is the function from the blog.163.com case that's tripping, haven't had a chance to extract from AOL yet:

function() {
    var batch = {
        map: {
            callCount: 0,
            page: window.location.pathname + window.location.search,
            httpSessionId: dwr.engine._getJSessionId(),
            scriptSessionId: dwr.engine._getScriptSessionId()
        },
        charsProcessed: 0,
        paramCount: 0,
        headers: [],
        parameters: [],
        isPoll: false,
        headers: {},
        handlers: {},
        preHooks: [],
        postHooks: [],
        rpcType: dwr.engine._rpcType,
        httpMethod: dwr.engine._httpMethod,
        async: dwr.engine._async,
        timeout: dwr.engine._timeout,
        errorHandler: dwr.engine._errorHandler,
        warningHandler: dwr.engine._warningHandler,
        textHtmlHandler: dwr.engine._textHtmlHandler
    };
    if (dwr.engine._preHook) batch.preHooks.push(dwr.engine._preHook);
    if (dwr.engine._postHook) batch.postHooks.push(dwr.engine._postHook);
    var propname,
    data;
    if (dwr.engine._headers) {
        for (propname in dwr.engine._headers) {
            data = dwr.engine._headers[propname];
            if (typeof data != "function") batch.headers[propname] = data;
        }
    }
    if (dwr.engine._parameters) {
        for (propname in dwr.engine._parameters) {
            data = dwr.engine._parameters[propname];
            if (typeof data != "function") batch.parameters[propname] = data;
        }
    }
    return batch;
}

Comment 3

[Brendan Eich [:brendan]]

Attachment: proposed fix

Shaver, thanks for the help -- can you test and r+? Thanks,

/be

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 306589 [details] [diff] [review]
proposed fix

r=shaver

test fodder:

for (var i = 0; i < 2; i++)
    dict = {p: 1, q: 1, p:1};

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 306589 [details] [diff] [review]
proposed fix

Would like to get this in ASAP.

/be

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 306589 [details] [diff] [review]
proposed fix

a1.9b4=beltzner

Comment 7

[Brendan Eich [:brendan]]

Fixed:

js/src/jsinterp.c 3.451

/be

Comment 8

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/ecma_3/Regress/regress-420087.js,v  <--  regress-420087.js
initial revision: 1.1

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.9.0