687398 - Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSString::isLinear]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 06445f55f009 (options -m -n):


var handler = { "\u0039" : function() {} };
var g = newGlobal('new-compartment');
findReferences(g);


Not sure if this is a bug, as findReferences is internal. S-s because this is a GC related issue and it crashes when stepping through the assert.

Comment 1

[Christian Holler (:decoder)]

Same test without newGlobal but same assert and crash signature:

var obj = {"-1" : function() {}};
(function f() { findReferences(f); })();

Comment 2

[David Mandelin [:dmandelin]]

Not s-s. The debug printing function PrintPropertyMethod asserts that Shape::propid is an atom, but that's false.

Comment 3

[David Mandelin [:dmandelin]]

Attachment: Patch

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 565700 [details] [diff] [review]
Patch

Review of attachment 565700 [details] [diff] [review]:
-----------------------------------------------------------------

Who wouldn't guess that XML namespaces can be method property names as well? ;-)

::: js/src/jsgcmark.cpp
@@ +553,5 @@
>  {
>      MarkXML(trc, thing, name);
>  }
>  
> +static void PrintPropertyId(char *buf, size_t bufsize, jsid propid, const char *label)

Nit: newline after void.

Comment 5

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/96b2321ec26c

Comment 6

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/96b2321ec26c

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929