Last Comment Bug 687398 - Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSString::isLinear]
: Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSSt...
Status: RESOLVED FIXED
js-triage-done
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla10
Assigned To: David Mandelin [:dmandelin]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-09-18 20:21 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:16 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (2.43 KB, patch)
2011-10-07 18:49 PDT, David Mandelin [:dmandelin]
cdleary: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-09-18 20:21:52 PDT
The following test asserts on mozilla-central revision 06445f55f009 (options -m -n):


var handler = { "\u0039" : function() {} };
var g = newGlobal('new-compartment');
findReferences(g);


Not sure if this is a bug, as findReferences is internal. S-s because this is a GC related issue and it crashes when stepping through the assert.
Comment 1 Christian Holler (:decoder) 2011-09-28 11:18:43 PDT
Same test without newGlobal but same assert and crash signature:

var obj = {"-1" : function() {}};
(function f() { findReferences(f); })();
Comment 2 David Mandelin [:dmandelin] 2011-10-07 18:40:40 PDT
Not s-s. The debug printing function PrintPropertyMethod asserts that Shape::propid is an atom, but that's false.
Comment 3 David Mandelin [:dmandelin] 2011-10-07 18:49:27 PDT
Created attachment 565700 [details] [diff] [review]
Patch
Comment 4 Chris Leary [:cdleary] (not checking bugmail) 2011-10-08 12:08:15 PDT
Comment on attachment 565700 [details] [diff] [review]
Patch

Review of attachment 565700 [details] [diff] [review]:
-----------------------------------------------------------------

Who wouldn't guess that XML namespaces can be method property names as well? ;-)

::: js/src/jsgcmark.cpp
@@ +553,5 @@
>  {
>      MarkXML(trc, thing, name);
>  }
>  
> +static void PrintPropertyId(char *buf, size_t bufsize, jsid propid, const char *label)

Nit: newline after void.
Comment 5 David Mandelin [:dmandelin] 2011-10-10 15:16:35 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/96b2321ec26c
Comment 6 Marco Bonardo [::mak] 2011-10-11 02:37:01 PDT
https://hg.mozilla.org/mozilla-central/rev/96b2321ec26c
Comment 7 Christian Holler (:decoder) 2013-01-19 14:16:14 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.