643250 - TI: Crash [@ js::types::TypeObject::storeToInstances] or "Assertion failure: JSID_IS_STRING(id)," or "Assertion failure: JSID_BITS(id) == JSID_TYPE_VOID,"

Status: RESOLVED DUPLICATE of bug 643284

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

o = ['']
Uint8ClampedArray.b
function f4() {
    _someglobal_ = o
    try {
        eval()
    } catch(e) {}
    _someglobal_['__proto_' + '_'] = null
}
for (var i = 0; i < 10; i++) {
    f4()
    gc()
}


asserts or crashes js debug shell on JM changeset 5ce2f7a90286 with -m, -a and -n [@ js::types::TypeObject::storeToInstances] or Assertion failure: JSID_IS_STRING(id), or Assertion failure: JSID_BITS(id) == JSID_TYPE_VOID,

Pass this in as a CLI argument to reproduce. The error messages rotate among each other.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: crash stack