Last Comment Bug 687398 - Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSString::isLinear]
: Assertion failure: JSID_IS_ATOM(propid), at jsgcmark.cpp:595 or Crash [@ JSSt...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: mozilla10
Assigned To: David Mandelin [:dmandelin]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-09-18 20:21 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:16 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (2.43 KB, patch)
2011-10-07 18:49 PDT, David Mandelin [:dmandelin]
cdleary: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-09-18 20:21:52 PDT
The following test asserts on mozilla-central revision 06445f55f009 (options -m -n):

var handler = { "\u0039" : function() {} };
var g = newGlobal('new-compartment');

Not sure if this is a bug, as findReferences is internal. S-s because this is a GC related issue and it crashes when stepping through the assert.
Comment 1 User image Christian Holler (:decoder) 2011-09-28 11:18:43 PDT
Same test without newGlobal but same assert and crash signature:

var obj = {"-1" : function() {}};
(function f() { findReferences(f); })();
Comment 2 User image David Mandelin [:dmandelin] 2011-10-07 18:40:40 PDT
Not s-s. The debug printing function PrintPropertyMethod asserts that Shape::propid is an atom, but that's false.
Comment 3 User image David Mandelin [:dmandelin] 2011-10-07 18:49:27 PDT
Created attachment 565700 [details] [diff] [review]
Comment 4 User image Chris Leary [:cdleary] (not checking bugmail) 2011-10-08 12:08:15 PDT
Comment on attachment 565700 [details] [diff] [review]

Review of attachment 565700 [details] [diff] [review]:

Who wouldn't guess that XML namespaces can be method property names as well? ;-)

::: js/src/jsgcmark.cpp
@@ +553,5 @@
>  {
>      MarkXML(trc, thing, name);
>  }
> +static void PrintPropertyId(char *buf, size_t bufsize, jsid propid, const char *label)

Nit: newline after void.
Comment 5 User image David Mandelin [:dmandelin] 2011-10-10 15:16:35 PDT
Comment 6 User image Marco Bonardo [::mak] 2011-10-11 02:37:01 PDT
Comment 7 User image Christian Holler (:decoder) 2013-01-19 14:16:14 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.