587268 - "Assertion failure: !p" with duplicate form elements [@ Enumerate<KeyEnumeration>]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (triggers fatal assertion when loaded)

This fuzzer-found bug might turn out to be the same as website-found bug 581776.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jeff Walden [:Waldo]]

This is basically the objectops version of bug 580200's proxy-returns-same-property-twice bug: the document.forms object's enumerator returns the same name twice, and assertion hilarity ensues.  Perhaps we should update the assertion to exclude these objects as well...

Comment 3

[Jesse Ruderman]

Still happens on trunk.  Seems harmless in opt.

Comment 5

[Bob Clary [:bc] (inactive)]

Note this can happen with checkbox input elements with the same name and could be quite common though so far I've only seen it on home.eease.com, home.eease.adp.com and tagged.com. While it might not affect the user, it can hide other issues from the crash automation.

Comment 6

[Andreas Gal :gal]

Whats the right behavior here? Should we enumerate twice? I guess host-objects are allowed to do that, but this invalidates all the effort we put into proxies to make keys unique.

Comment 7

[Jeff Walden [:Waldo]]

I'd think double-enumeration is a bug that should be fixed.  What purpose does it serve?

What do other browsers do?

Comment 8

[Bob Clary [:bc] (inactive)]

changing the var e in f loop body to

for (var e in f) { output.innerHTML += '<div>' + e + '</div>';}

g appears once in Nightly and does not appear at all in Chrome, Safari, or Opera.

This is still pretty common in crash testing. Can we just remove the assertion if we can't figure out if it is a problem?

Comment 9

[Jeff Walden [:Waldo]]

Attachment: Patch

Comment 10

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/11d5e81d190f

Comment 11

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/11d5e81d190f