Last Comment Bug 746791 - "Assertion failure: js_CheckForStringIndex(ida->vector[n]) == ida->vector[n]," with e4x
: "Assertion failure: js_CheckForStringIndex(ida->vector[n]) == ida->vector[n],...
Status: RESOLVED FIXED
js-triage-needed
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 699565
  Show dependency treegraph
 
Reported: 2012-04-18 16:29 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-07-26 15:03 PDT (History)
8 users (show)
gary: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (6.82 KB, text/plain)
2012-04-18 16:29 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
add testcase (570 bytes, patch)
2012-07-26 14:27 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-04-18 16:29:38 PDT
Created attachment 616340 [details]
stack

g = evalcx("");
f = function () {};
Object.defineProperty(f, QName(1), {
    enumerable: 2
});
g.h = f;
for (v of g) {}

asserts js debug shell on m-c changeset cc3e893fbe1c without any CLI arguments at Assertion failure: js_CheckForStringIndex(ida->vector[n]) == ida->vector[n],

This looks somewhat different from bug 569024 and bug 695647.
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-04-18 17:06:15 PDT
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   86351:90ecec15f74b
user:        Jason Orendorff
date:        Tue Feb 07 12:57:16 2012 -0600
summary:     Bug 699565 - Part 1 - for-of loop basics. r=Waldo.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-04-20 14:58:40 PDT
Reproduced on 32-bit Mac js shells.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-05-21 16:00:19 PDT
Seems fixed by bug 751331.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   93320:86d28b6fa4fc
user:        Brian Hackett
date:        Sun May 06 13:45:19 2012 -0700
summary:     Disallow non-canonical jsids, bug 751331. r=luke
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2012-07-26 14:27:12 PDT
Created attachment 646340 [details] [diff] [review]
add testcase

Luke, could you pls take a quick glance at this?

Anthony, in js/src/jit-test, I ran:

python jit_test.py <path to js shell> bug746791.js

(there is no need to input the relative path to the testcase, just the testcase name will do)

and got:

[   2|   0|   0|   2]    100% =======================================>|    0.1s
PASSED ALL


Without the |jit-test| comment line (or with an incorrect error expected) at the top, I got:

/Users/skywalker/trees/mozilla-inbound/js/src/jit-test/tests/basic/bug746791.js:8: TypeError: g is not iterable
Exit code: 3
[   0|   1|   0|   1]     50% ===================>                    |    0.1s/Users/skywalker/trees/mozilla-inbound/js/src/jit-test/tests/basic/bug746791.js:8: TypeError: g is not iterable
Exit code: 3
[   0|   2|   0|   2]    100% =======================================>|    0.2s
FAILURES:
    -m /Users/skywalker/trees/mozilla-inbound/js/src/jit-test/tests/basic/bug746791.js
    -m -n /Users/skywalker/trees/mozilla-inbound/js/src/jit-test/tests/basic/bug746791.js
TIMEOUTS:
Comment 5 Luke Wagner [:luke] 2012-07-26 14:59:08 PDT
This test has a QName; e4x is about to be turned off and we are removing/nerfing tests, iiuc, so perhaps we shouldn't add this test.
Comment 6 Gary Kwong [:gkw] [:nth10sd] 2012-07-26 15:02:24 PDT
(In reply to Luke Wagner [:luke] from comment #5)
> This test has a QName; e4x is about to be turned off and we are
> removing/nerfing tests, iiuc, so perhaps we shouldn't add this test.

Good point, I was just trying to find a test as an example for Anthony.

Note You need to log in before you can comment on or make changes to this bug.