675581 - "Assertion failure: js_CheckForStringIndex(id) == id" with e4x

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x=<x/>
x.(-0 in x)

asserts js debug shell on MI changeset b4165ae3685f without any CLI arguments at Assertion failure: js_CheckForStringIndex(id) == id,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   73438:cad13a541e30
user:        Jason Orendorff
date:        Wed Jul 27 17:44:29 2011 -0500
summary:     Bug 651940 - When hashing a jsid, assert that js_CheckForStringIndex(id) == id. r=Waldo.

Comment 1

[Jason Orendorff [:jorendorff]]

This invariant is old. Only the assertion is new in that revision.

This is probably a very old bug. Removing the bugzilla dependency.

Looking into it.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

Here E4X is using a function whose only other caller is JS_Alias*. Whee.

Comment 3

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/e605ebcd5984

Comment 4

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/e605ebcd5984

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-675581.js.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.