Note: There are a few cases of duplicates in user autocompletion which are being worked on.

Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSString::isLinear]

RESOLVED FIXED in mozilla10

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: dmandelin)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla10
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-done, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision 06445f55f009 (options -m -n):


var handler = { "\u0039" : function() {} };
var g = newGlobal('new-compartment');
findReferences(g);


Not sure if this is a bug, as findReferences is internal. S-s because this is a GC related issue and it crashes when stepping through the assert.
(Reporter)

Comment 1

6 years ago
Same test without newGlobal but same assert and crash signature:

var obj = {"-1" : function() {}};
(function f() { findReferences(f); })();
(Assignee)

Comment 2

6 years ago
Not s-s. The debug printing function PrintPropertyMethod asserts that Shape::propid is an atom, but that's false.
Group: core-security
Whiteboard: js-triage-needed → js-triage-done
(Assignee)

Updated

6 years ago
Assignee: general → dmandelin
(Assignee)

Comment 3

6 years ago
Created attachment 565700 [details] [diff] [review]
Patch
Attachment #565700 - Flags: review?(cdleary)
Comment on attachment 565700 [details] [diff] [review]
Patch

Review of attachment 565700 [details] [diff] [review]:
-----------------------------------------------------------------

Who wouldn't guess that XML namespaces can be method property names as well? ;-)

::: js/src/jsgcmark.cpp
@@ +553,5 @@
>  {
>      MarkXML(trc, thing, name);
>  }
>  
> +static void PrintPropertyId(char *buf, size_t bufsize, jsid propid, const char *label)

Nit: newline after void.
Attachment #565700 - Flags: review?(cdleary) → review+
(Assignee)

Comment 5

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/96b2321ec26c
Target Milestone: --- → mozilla10
https://hg.mozilla.org/mozilla-central/rev/96b2321ec26c
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 7

5 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.