Last Comment Bug 675581 - "Assertion failure: js_CheckForStringIndex(id) == id" with e4x
: "Assertion failure: js_CheckForStringIndex(id) == id" with e4x
Status: VERIFIED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla8
Assigned To: Jason Orendorff [:jorendorff]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-08-01 01:27 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-10 16:38 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (4.45 KB, text/plain)
2011-08-01 01:27 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
v1 (2.07 KB, patch)
2011-08-03 17:38 PDT, Jason Orendorff [:jorendorff]
jwalden+bmo: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-08-01 01:27:26 PDT
Created attachment 549740 [details]
stack

x=<x/>
x.(-0 in x)

asserts js debug shell on MI changeset b4165ae3685f without any CLI arguments at Assertion failure: js_CheckForStringIndex(id) == id,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   73438:cad13a541e30
user:        Jason Orendorff
date:        Wed Jul 27 17:44:29 2011 -0500
summary:     Bug 651940 - When hashing a jsid, assert that js_CheckForStringIndex(id) == id. r=Waldo.
Comment 1 Jason Orendorff [:jorendorff] 2011-08-03 17:28:26 PDT
This invariant is old. Only the assertion is new in that revision.

This is probably a very old bug. Removing the bugzilla dependency.

Looking into it.
Comment 2 Jason Orendorff [:jorendorff] 2011-08-03 17:38:44 PDT
Created attachment 550568 [details] [diff] [review]
v1

Here E4X is using a function whose only other caller is JS_Alias*. Whee.
Comment 3 Jason Orendorff [:jorendorff] 2011-08-08 10:41:08 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/e605ebcd5984
Comment 5 Christian Holler (:decoder) 2013-01-04 13:18:30 PST
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-675581.js.
Comment 6 Gary Kwong [:gkw] [:nth10sd] 2013-01-10 16:38:08 PST
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.

Note You need to log in before you can comment on or make changes to this bug.