Last Comment Bug 725003 - IonMonkey: Assertion failure: js_CheckForStringIndex(id) == id, at js/src/jsatom.h:107
: IonMonkey: Assertion failure: js_CheckForStringIndex(id) == id, at js/src/jsa...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-02-07 10:26 PST by Christian Holler (:decoder)
Modified: 2013-01-14 07:38 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (2.59 KB, patch)
2012-02-08 14:52 PST, David Anderson [:dvander]
bhackett1024: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-02-07 10:26:25 PST
The following testcase asserts on ionmonkey revision c34398f961e7 (run with --ion -n), tested on 64 bit:


function TestCase(n, d, e, a) {
  this.name = n;
  this.description = d;
  this.expect = e;
  this.actual = a;
  this.passed = getTestCaseResult(e, a);
  this.reason = '';
}
function getTestCaseResult(expected, actual) {}
var obj = new Function();
for (var i = 0; i < 100; i++) {
        obj['-1'] = new Array();
    assertEq(obj['-1'] == null, false);
    obj = new TestCase();
}
Comment 1 David Anderson [:dvander] 2012-02-08 14:52:57 PST
Created attachment 595547 [details] [diff] [review]
fix

Long-term we should probably use lookupProperty but for now this is fine.
Comment 2 David Anderson [:dvander] 2012-02-08 17:06:20 PST
http://hg.mozilla.org/projects/ionmonkey/rev/63d066d8186b
Comment 3 Christian Holler (:decoder) 2013-01-14 07:38:04 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug725003.js.

Note You need to log in before you can comment on or make changes to this bug.