1000225 - Assertion failure: js(), at js/ProfilingStack.h:64 or Crash [@ js::ProfileEntry::setPC]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision ac376a4e8174 (run with --fuzzing-safe --ion-eager):


arr = [];
arr.watch('length', watcher);
try {
  arr.push(5);
} catch(ex) {
  arr.pop();
}
function watcher(propname, oldval, newval) {
  return (function() {
   var n = 50;
   while (n--) {
     disableSPSProfiling();
     if (!n)
       return;
     enableSPSProfilingAssertions(true);
   }
  })();
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Kannan / Jan, is this another SPS issue related to bug 970252 or bug 994406?

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/88288ea65ef8
user:        Steve Fink
date:        Mon Apr 01 17:58:37 2013 -0700
summary:     Bug 822041 - Do not copy hasPushedSPSFrame() from heap generator frame. r=luke

This iteration took 81.981 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from Steve based on comment 3 :)

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b7062df8c7c3).

Comment 6

[Christian Holler (:decoder)]

arr = [];
arr.watch('length', watcher);
try {
  arr.push(5);
} catch(ex) {
  arr.pop();
}
function watcher(propname, oldval, newval) {
  return (function() {
   var n = 50;
   while (n--) {
     disableSPSProfiling();
     if (!n)
       return;
     enableSPSProfilingWithSlowAssertions();
   }
  })();
}


Let's try this with JSBugMon :)

Comment 7

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 8

[Steve Fink [:sfink] [:s:]]

I'm assuming this will disappear with djvj's new frame walking stuff. Either that, or it's already gone.

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 12

[Calixte Denizet (:calixte)]

:decoder, is this bug still alive ?

Comment 13

[Christian Holler (:decoder)]

I would assume this bug is gone because Array.watch() has been removed.

JSBugMon didn't report this because it couldn't automatically track this bug in the first place for some reason.

Closing as WORKSFORME because we removed the underlying code, but I don't know where.