533258 - "Assertion failure: hasMethodBarrier()" with ckeditor

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

1. http://demos.theactivegroup.com/?demo=media&script=audioev
2. Assertion failure: hasMethodBarrier(), at /work/mozilla/builds/1.9.3/mozilla/js/src/jsscopeinlines.h:80

Comment 1

[Bob Clary [:bc] (inactive)]

theactivegroup assert was implicated in a NPSWF32.dll@0x139215 crash on windows while http://demos.theactivegroup.com/?demo=media&script=audioev was implicated in a npdsplay.dll@0x1e8b3 crash on windows.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Slightly reduced testcase

Random thought... :

For some reason I'm unable to change the line involving http://www.drugme.ru/media/js/ckeditor/ckeditor.js

Comment 4

[Jesse Ruderman]

Still happens on TM branch (loaded testcase in comment 3 using TM rev aeb1809789d9).

Comment 5

[Jesse Ruderman]

Attachment: self-contained, non-reduced testcase

The script http://www.drugme.ru/media/js/ckeditor/ckeditor.js checks its location (by looking at the "src" attribute of the relevant "script" element) and loads additional files from the same directory.  No wonder it was tricky to make the testcase self-contained!

Comment 6

[Jeff Walden [:Waldo]]

I'll take a look at this tomorrow morning.

Comment 7

[Brendan Eich [:brendan]]

Attachment: fix

Sorry, my fault -- figured it out from the jsbeautifier.org'ed source.

/be

Comment 8

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/7edbd161983a

/be

Comment 9

[Jesse Ruderman]

Attachment: self-contained testcase, reduced a little bit

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: 300-line testcase

Reduced to 300 lines. This is about as good as I can get for the moment.

Comment 11

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/7edbd161983a