450056 - TM: shell rt benchmark causes !JSVAL_IS_PRIMITIVE assertion failure

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Same benchmark from bug 450035, with tip tracemonkey (80de10) causes bus error in opt build and assertion failure in debug build:

object<0x32a150:Function> object<0x32a150:Function> object<0x32b1a0:Object> string<0x32d860> object<0x32b220:Iterator> this0=object<0x32a150:Function> argv0=object<0x32a150:Function> argv1=object<0x32b1a0:Object> vars0=string<0x32d860> stack0=object<0x32b220:Iterator> 
global shape mismatch, flushing cache.
Flushing cache.
Assertion failure: !JSVAL_IS_PRIMITIVE(v), at jsiter.cpp:443

(gdb) where
#0  JS_Assert (s=0x167ad8 "!JSVAL_IS_PRIMITIVE(v)", file=0x1641fd "jsiter.cpp", ln=443) at jsutil.cpp:63
#1  0x000874f9 in js_CloseIterator (cx=0x0, v=2110940) at jsiter.cpp:443
#2  0x0007b1fb in js_Interpret (cx=0x2005f0) at jsinterp.cpp:6601
#3  0x0008319d in js_Execute (cx=0x2005f0, chain=0x32b000, script=0x80d200, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1545
#4  0x00018974 in JS_ExecuteScript (cx=0x2005f0, obj=0x32b000, script=0x80d200, rval=0x0) at jsapi.cpp:4929
#5  0x00002d25 in Load (cx=0x2005f0, obj=0x32b000, argc=1, argv=0x806a68, rval=0xbfffd780) at js.cpp:663
#6  0x000845b4 in js_Invoke (cx=0x2005f0, argc=1, vp=0x806a60, flags=2) at jsinterp.cpp:1306
#7  0x00071fad in js_Interpret (cx=0x2005f0) at jsinterp.cpp:4906
#8  0x0008319d in js_Execute (cx=0x2005f0, chain=0x32b000, script=0x2030b0, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1545
#9  0x00018974 in JS_ExecuteScript (cx=0x2005f0, obj=0x32b000, script=0x2030b0, rval=0x0) at jsapi.cpp:4929
#10 0x00002682 in Process (cx=0x2005f0, obj=0x32b000, filename=0xbffff710 "go.js", forceTTY=0) at js.cpp:277
#11 0x00007d3a in ProcessArgs (cx=0x2005f0, obj=0x32b000, argv=0xbffff5e0, argc=3) at js.cpp:510
#12 0x00009000 in main (argc=3, argv=0xbffff5e0, envp=0xbffff5f0) at js.cpp:3981

(gdb) up
#1  0x000874f9 in js_CloseIterator (cx=0x0, v=2110940) at jsiter.cpp:443
443	    JS_ASSERT(!JSVAL_IS_PRIMITIVE(v));
(gdb) p v
$1 = 2110940
(gdb) p/x v
$2 = 0x2035dc

Comment 1

[Brendan Eich [:brendan]]

Does not crash for me. Are you sure you have a consistent build? Makefile.ref fails to generate header dependencies reliably; clobber is good practice to prove a crash is not due to a bad incremental build.

/be

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Ah! Yep, that was the cause.  Sorry for spam!