563118 - "Assertion failure: !(XMLArrayFindMember(&ancdecls.array, ns2, namespace_identity) != (4294967295U))," with duplicated E4X namespace

Status: VERIFIED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

var link = <link/>;
var xlinkNamespace = new Namespace('xlink', 'http://www.w3.org/1999/xlink');
link.addNamespace(xlinkNamespace);
link.addNamespace(xlinkNamespace);
link.toXMLString();

Assertion failure: !XMLARRAY_HAS_MEMBER(&ancdecls, ns2, namespace_identity), at ../jsxml.cpp:2571

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Not the smallest) regression window:

01012003 js shell build does not assert.
01012006 js shell build asserts.

Comment 2

[Brendan Eich [:brendan]]

No problem in opt builds, even under valgrind, right?

Seems low priority. Would be good to id the regressor.

/be

Comment 3

[Jesse Ruderman]

No problem in opt, even under valgrind.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> No problem in opt builds, even under valgrind, right?
> 
> Seems low priority. Would be good to id the regressor.
> 
> /be

A manual CVS bisect shows this is probably related to bug 309242:

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=mozilla%2Fjs%2Fsrc&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-09-20+12%3A00%3A00&maxdate=2005-09-20+18%3A00%3A00&cvsroot=%2Fcvsroot

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Now asserts at Assertion failure: !XMLARRAY_HAS_MEMBER(&ancdecls.array, ns2, namespace_identity), instead.

Comment 6

[David Mandelin [:dmandelin]]

Seems low priority => doesn't block.

Comment 7

[Igor Bukanov]

The assertion is harmless as it just quires inconsistency and the violated inconsistency at that point results just in incorrect toString output for e4x.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

$ ./js-dbg-32-mozilla-central-linux -e 'options("allow_xml");' 563118.js 
Assertion failure: !(XMLArrayFindMember(&ancdecls.array, ns2, namespace_identity) != (4294967295U)),

The assert has morphed as of mozilla-central changeset 6c60e99d9739 - this assert is likely to go away once e4x is removed in Firefox (scheduled for version 18).

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

E4X is now history thanks to bug 788293. -> WONTFIX

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Running the testcase through the js shell now throws a syntax error:

563118.js:1:0 SyntaxError: syntax error:
563118.js:1:0 var link = <link/>;
563118.js:1:0 ...........^