1034383 - Assertion failure: hasScript(), at jsfun.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = [];
Object.defineProperty(x, 8, {
    get: (function(j) {})
});
Object.defineProperty(this, "y", {
    get: function() {
        return x.filterPar(function() {});
    }
});
for (var a = 0; a < 99; a++) {
    Array.prototype.shift.call(y);
}

asserts js debug shell on m-c changeset 613bc15ccf05 with --ion-eager --ion-offthread-compile=off at Assertion failure: hasScript(), at jsfun.h

My configure flags are:

CC="gcc-4.7 -mfloat-abi=softfp -B/usr/lib/gcc/arm-linux-gnueabi/4.7" CXX="g++-4.7 -mfloat-abi=softfp -B/usr/lib/gcc/arm-linux-gnueabi/4.7" AR=ar sh /home/fuzz5lin/trees/mozilla-central/js/src/configure --target=arm-linux-gnueabi --enable-debug --enable-optimize --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

This is intermittent and mutates its signatures (sometimes unreliably crashes), so it would be nice to have this fixed. I'll see if I can get a bisection, but no promises here.

Setting s-s and sec-high as a start. Shu-yu, would you be able to take a look?

Comment 1

[Shu-yu Guo [:shu]]

Can't repro locally on emulator again. You know the drill. Could you trap it in gdb and get me access to a machine?

Comment 2

[Shu-yu Guo [:shu]]

Also see if it's reproducible with thread count of 1

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7a1c696cade6
user:        Shu-yu Guo
date:        Mon Apr 07 13:02:20 2014 -0700
summary:     Bug 974201 - Remove filterPar chunking. (r=nmatsakis)

Also, no, I don't think this is reproducible with --thread-count=1.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/5c805d803e11
user:        Douglas Crosher
date:        Tue Jul 08 09:42:00 2014 +1000
summary:     Bug 1013056. r=shu

Probably fixed by 1013056, which Shu-yu confirmed over IRC.

Comment 5

[Kamil Jozwiak [:kjozwiak]]

I'm going to mark this as [qa-] due to not being able to reproduce the original issue. I've tried reproducing using the flags in comment #0 on the emulator with no luck :/ Looks like :shu was also having issues reproducing the original issue in comment #1.

Also tried reproducing the issue using --thread-count=1 as suggested in comment #2.