"Assertion failure: js_CheckForStringIndex(id) == id" with e4x

VERIFIED FIXED in mozilla8

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
6 years ago
4 years ago

People

(Reporter: gkw, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla8
x86
Mac OS X
assertion, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 549740 [details]
stack

x=<x/>
x.(-0 in x)

asserts js debug shell on MI changeset b4165ae3685f without any CLI arguments at Assertion failure: js_CheckForStringIndex(id) == id,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   73438:cad13a541e30
user:        Jason Orendorff
date:        Wed Jul 27 17:44:29 2011 -0500
summary:     Bug 651940 - When hashing a jsid, assert that js_CheckForStringIndex(id) == id. r=Waldo.
Whiteboard: js-triage-needed
(Assignee)

Comment 1

6 years ago
This invariant is old. Only the assertion is new in that revision.

This is probably a very old bug. Removing the bugzilla dependency.

Looking into it.
No longer blocks: 651940
(Assignee)

Comment 2

6 years ago
Created attachment 550568 [details] [diff] [review]
v1

Here E4X is using a function whose only other caller is JS_Alias*. Whee.
Assignee: general → jorendorff
Attachment #550568 - Flags: review?(jwalden+bmo)
Attachment #550568 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Updated

6 years ago
Summary: "Assertion failure: js_CheckForStringIndex(id) == id," with e4x → "Assertion failure: js_CheckForStringIndex(id) == id" with e4x
(Assignee)

Comment 3

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/e605ebcd5984
Whiteboard: js-triage-needed → [inbound]
http://hg.mozilla.org/mozilla-central/rev/e605ebcd5984
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
Target Milestone: --- → mozilla8
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-675581.js.
Flags: in-testsuite+
(Reporter)

Comment 6

4 years ago
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.