774933 - "Assertion failure: any" in AutoGCSession::AutoGCSession with verifybarriers

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi
2. Load the testcase in a debug build (from the command line?)

Assertion failure: any, at js/src/jsgc.cpp:3570

I can reproduce using https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1342515922/ but not using a local debug build :(

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

I forgot to call Prepare before the GC. Regression from bug 774104.

This API is kinda crappy. I'm going to work on simplifying it soon.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b3de7703f20b

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/b3de7703f20b

Comment 5

[Daniel Veditz [:dveditz]]

(In reply to Bill McCloskey (:billm) from comment #2)
> I forgot to call Prepare before the GC. Regression from bug 774104.

Based on that marking this tracking for Fx16

Comment 6

[Alex Keybl [:akeybl]]

Can we get this nominated and landed on Aurora 16 prior to Monday's merge?

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This assertion is more of a sanity check. I don't think anything bad will happen if it's violated, so I don't think we need this on Aurora.

Comment 8

[Alex Keybl [:akeybl]]

(In reply to Bill McCloskey (:billm) from comment #7)
> This assertion is more of a sanity check. I don't think anything bad will
> happen if it's violated, so I don't think we need this on Aurora.

Thanks Bill - we'll untrack in that case.

Comment 9

[Virgil Dicu [:virgil] [QA]]

Can't reproduce the assertion with the latest beta debug build (http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-11-04-mozilla-beta-debug/) but couldn't reproduce with a build from the report date either so i'll leave the verified status as is for the moment.

Comment 10

[u279076]

Jesse, can you see if this is still reproducible for you? QA is not able to reproduce on the reported build.

Comment 11

[Jesse Ruderman]

Fine on trunk.  I tested with "verifyprebarriers", the closest equivalent to the "verifybarriers" that existed at the time of filing, and also with "verifypostbarriers".

Comment 12

[u279076]

Thanks Jesse.