Closed Bug 687398 Opened 8 years ago Closed 8 years ago

Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSString::isLinear]

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla10

People

(Reporter: decoder, Assigned: dmandelin)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: js-triage-done)

Crash Data

Attachments

(1 file)

The following test asserts on mozilla-central revision 06445f55f009 (options -m -n):


var handler = { "\u0039" : function() {} };
var g = newGlobal('new-compartment');
findReferences(g);


Not sure if this is a bug, as findReferences is internal. S-s because this is a GC related issue and it crashes when stepping through the assert.
Same test without newGlobal but same assert and crash signature:

var obj = {"-1" : function() {}};
(function f() { findReferences(f); })();
Not s-s. The debug printing function PrintPropertyMethod asserts that Shape::propid is an atom, but that's false.
Group: core-security
Whiteboard: js-triage-needed → js-triage-done
Assignee: general → dmandelin
Attached patch PatchSplinter Review
Attachment #565700 - Flags: review?(cdleary)
Comment on attachment 565700 [details] [diff] [review]
Patch

Review of attachment 565700 [details] [diff] [review]:
-----------------------------------------------------------------

Who wouldn't guess that XML namespaces can be method property names as well? ;-)

::: js/src/jsgcmark.cpp
@@ +553,5 @@
>  {
>      MarkXML(trc, thing, name);
>  }
>  
> +static void PrintPropertyId(char *buf, size_t bufsize, jsid propid, const char *label)

Nit: newline after void.
Attachment #565700 - Flags: review?(cdleary) → review+
https://hg.mozilla.org/mozilla-central/rev/96b2321ec26c
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.