291312 - newborn script filename table entry not saved by GC_KEEP_ATOMS

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Michiel van Leeuwen (email: mvl+moz@)]

Inspired by bug 291210, i tried to set TOO_MUCH_GC to see how calendar handles
it. Badly, it seems. It crashes on startup with:
Assertion failure: sfe->key == sfe->filename, at
/home/michiel/mozhack/tree1/mozilla/js/src/jsscript.c:1026

Comment 1

[Michiel van Leeuwen (email: mvl+moz@)]

Attachment: stack

This is the stack.
(The string in frame 20 is the start of monthView.js, if that helps anything)

Comment 2

[Michiel van Leeuwen (email: mvl+moz@)]

irc log on debugging this:

<mvl>	(gdb) p *script
<mvl>	$4 = {code = 0x8529140 "\177", length = 90, main = 0x8529143 "l", version = 0,
<mvl>	  numGlobalVars = 0, atomMap = {vector = 0x85291c8, length = 9},
<mvl>	  filename = 0x85291fd "", lineno = 57, depth = 3, trynotes = 0x0,
<mvl>	  principals = 0x81be77c, object = 0x84e2560}
<brendan>	empty string filename
<brendan>	in frame 4, what is *sfe
<mvl>	(gdb) p *sfe
<mvl>	$6 = {next = 0x1, keyHash = 60, key = 0x430067, mark = 97 'a',
<mvl>	  filename = "\000l"}
<brendan>	that's not good
<brendan>	in frame 10, what is *rhe?
<mvl>	(gdb) p *rhe
<mvl>	$9 = {hdr = {keyHash = 4288663528}, root = 0x8528ca0,
<mvl>	  name = 0xb781e7d8 "nsXULPrototypeScript::mJSObject"}
<brendan>	also, let's look at $4 harder
<brendan>	x/3b $4.code
<mvl>	0x8529140:      0x7f    0x00    0x00
<brendan>	p *script.atomMap.vector[0]
<mvl>	$10 = {entry = {next = 0x847e960, keyHash = 1619793585, key = 0x84e20cc,
<mvl>	    value = 0x0}, flags = 4, number = 4669}
<brendan>	p *(JSString *)((long)$.entry.key - 4)
<mvl>	$11 = {length = 15, chars = 0x84e4fa8}
<brendan>	x/15ch $.chars
<mvl>	0x84e4fa8:      65 'A'  114 'r' 114 'r' 97 'a'  121 'y' 79 'O'  102 'f' 68 'D'
<mvl>	0x84e4fb8:      97 'a'  121 'y' 78 'N'  97 'a'  109 'm' 101 'e' 115 's'
<brendan>	ok, find the script whose only declared var is called that
<mvl>
http://lxr.mozilla.org/seamonkey/source/calendar/resources/content/monthView.xul#57
<mvl>	a <script/> element actually
<brendan>	inline script, hmm
<brendan>	in an overlay
<brendan>	the script seems intact, but its script filename table entry has been GC'd
<brendan>	one thing to check: does anyone else in the XUL we host do that?
<brendan>	maybe you've just found an old bug in overlays


on the last question:
monthView.xul, dayView.xul and the other views all include a copy of the same
<script/>. All those files overlay calendar.xul. I can of course fix that, but i
wonder if the actual error should be fixed instead.

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

Trivial fix, self-approving.

/be

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 182636 [details] [diff] [review]
fix

r=shaver

Comment 5

[Brendan Eich [:brendan]]

Fixed, thanks all.

/be