1064159 - Shumway hits SpiderMonkey assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Chris Peterson [:cpeterson]]

This assertion failure (from bug 618690) started when the new (TypeScript) version of Shumway was merged to mozilla-central by bug 1061888 on 2014-08-05.

STR:
1. Enable Shumway by flipping about:config pref "shumway.disabled" to false.
2. Running a debug build, load Flash site http://www.zombo.com

RESULT:

Assertion failure: !unknownProperties(), at /builds/slave/m-cen-osx64-d-0000000000000000/build/js/src/jsinferinlines.h:1234

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x000000010465187c in js_GetScriptLineExtent ()
(gdb) bt
#0  0x000000010465187c in js_GetScriptLineExtent ()
#1  0x00000001045c2630 in JS::GetGCNumber ()
#2  0x00000001045c285e in JS::GetGCNumber ()
#3  0x00000001045e5d52 in JS_CopyPropertiesFrom ()
#4  0x00000001045e5944 in JS_CopyPropertiesFrom ()
#5  0x000000010465a9ed in js_GetScriptLineExtent ()
#6  0x000000010473ab36 in js::ProfilingGetPC ()
#7  0x00000001043173e0 in JS::HeapCellRelocate ()
#8  0x00000001000edd33 in ?? ()
#9  0x00000001253bab8c in ?? ()
#10 0x00000001367e9f60 in ?? ()
#11 0x0000000113b0442c in ?? ()
#12 0x0000000134bda358 in ?? ()
#13 0x00000001000e4940 in ?? ()
#14 0x00000001043288fb in JS::HeapCellRelocate ()
#15 0x00000001043283b2 in JS::HeapCellRelocate ()
#16 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#17 0x000000010471e2bb in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#18 0x000000010471f1b8 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#19 0x000000010471f417 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#20 0x000000010431cf0c in JS::HeapCellRelocate ()
#21 0x00000001000edb63 in ?? ()
#22 0x0000000135bdc820 in ?? ()
#23 0x00000001000e4940 in ?? ()
#24 0x00000001043288fb in JS::HeapCellRelocate ()
#25 0x00000001043283b2 in JS::HeapCellRelocate ()
#26 0x0000000104717dde in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#27 0x000000010470e9b4 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#28 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#29 0x000000010471eb6f in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#30 0x000000010431cff6 in JS::HeapCellRelocate ()
#31 0x00000001000edb63 in ?? ()
#32 0x0000000135bf9220 in ?? ()
#33 0x0000000113b0442c in ?? ()
#34 0x00000001359cbb80 in ?? ()
#35 0x00000001000e4940 in ?? ()
#36 0x00000001043288fb in JS::HeapCellRelocate ()
#37 0x00000001043283b2 in JS::HeapCellRelocate ()
#38 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#39 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#40 0x00000001045a1c89 in JS::CompileOptions::CompileOptions ()
#41 0x00000001253b06e8 in ?? ()
#42 0x0000000134af1590 in ?? ()
#43 0x00000001000e4940 in ?? ()
#44 0x00000001043288fb in JS::HeapCellRelocate ()
#45 0x00000001043283b2 in JS::HeapCellRelocate ()
#46 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#47 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#48 0x00000001045a1c89 in JS::CompileOptions::CompileOptions ()
#49 0x00000001253b06e8 in ?? ()
#50 0x00000001359c6a98 in ?? ()
#51 0x0000000113b0442c in ?? ()
#52 0x00000001359c6e20 in ?? ()
#53 0x0000000113b0442c in ?? ()
#54 0x00000001359cbb80 in ?? ()
#55 0x00000001000e4940 in ?? ()
#56 0x00000001043288fb in JS::HeapCellRelocate ()
#57 0x00000001043283b2 in JS::HeapCellRelocate ()
#58 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#59 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#60 0x00000001045a1c89 in JS::CompileOptions::CompileOptions ()
#61 0x00000001253b06e8 in ?? ()
#62 0x0000000134af1590 in ?? ()
#63 0x00000001000e4940 in ?? ()
#64 0x00000001043288fb in JS::HeapCellRelocate ()
#65 0x00000001043283b2 in JS::HeapCellRelocate ()
#66 0x0000000104717dde in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#67 0x000000010470e9b4 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#68 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#69 0x00000001045a35dc in JS::CompileOptions::CompileOptions ()
#70 0x0000000104739fe2 in js::ProfilingGetPC ()
#71 0x000000010471e32d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#72 0x00000001045a153c in JS::CompileOptions::CompileOptions ()
#73 0x0000000104739fe2 in js::ProfilingGetPC ()
#74 0x000000010471e32d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#75 0x0000000104717a3f in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#76 0x000000010470e9b4 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#77 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#78 0x00000001045a35dc in JS::CompileOptions::CompileOptions ()
#79 0x0000000104739fe2 in js::ProfilingGetPC ()
#80 0x000000010471e32d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#81 0x000000010471eb6f in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch ()
#82 0x0000000104534f8b in JS::CompileOptions::CompileOptions ()
#83 0x000000010233134b in js::BaseProxyHandler::finalizeInBackground ()
#84 0x000000010209cbc6 in imgLoader::SupportImageWithMimeType ()
#85 0x000000010208247a in imgLoader::SupportImageWithMimeType ()
#86 0x0000000102074a65 in imgLoader::SupportImageWithMimeType ()
#87 0x0000000102081fd7 in imgLoader::SupportImageWithMimeType ()
#88 0x00000001014d97b8 in XRE_AddJarManifestLocation ()
#89 0x00000001014d9aa0 in XRE_AddJarManifestLocation ()
#90 0x00000001014d4e94 in XRE_AddJarManifestLocation ()
#91 0x00000001014ffb9d in nsXPTCStubBase::Stub249 ()
#92 0x0000000102c83547 in mac_plugin_interposing_child_OnShowCursor ()
#93 0x0000000102cd86ce in mac_plugin_interposing_child_OnShowCursor ()
#94 0x00007fff8cff65b1 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ ()
#95 0x00007fff8cfe7c62 in __CFRunLoopDoSources0 ()
#96 0x00007fff8cfe73ef in __CFRunLoopRun ()
#97 0x00007fff8cfe6e75 in CFRunLoopRunSpecific ()
#98 0x00007fff86645a0d in RunCurrentEventLoopInMode ()
#99 0x00007fff866457b7 in ReceiveNextEventCommon ()
#100 0x00007fff866455bc in _BlockUntilNextEventMatchingListInModeWithFilter ()
#101 0x00007fff9223f24e in _DPSNextEvent ()
#102 0x00007fff9223e89b in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#103 0x0000000102cd7bc6 in mac_plugin_interposing_child_OnShowCursor ()
#104 0x00007fff9223299c in -[NSApplication run] ()
#105 0x0000000102cd8d86 in mac_plugin_interposing_child_OnShowCursor ()
#106 0x0000000103b403a2 in XRE_StartupTimelineRecord ()
#107 0x0000000103ba556f in XRE_InitCommandLine ()
#108 0x0000000103ba5c19 in XRE_InitCommandLine ()
#109 0x0000000103ba5fce in XRE_main ()
#110 0x00000001000022ac in start ()
(gdb)

Comment 1

[Chris Peterson [:cpeterson]]

Brian: this assertion failure is a regression from your "Singleton type set fix" bug 1041688 comment 40:

https://hg.mozilla.org/integration/mozilla-inbound/rev/7b20a4e9ce15

I saw hits assertion failure after the new (TypeScript) version of Shumway was merged to mozilla-central on 2014-08-05 (bug 1061888).

STR:
1. Enable Shumway by flipping about:config pref "shumway.disabled" to false.
2. Running a debug build, load Flash site http://www.zombo.com

RESULT:

Assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

The APIs for updating type properties are pretty convoluted and after this lands I'll write a patch to clean them up.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d3f70a7f2386

Comment 4

[David Baron :dbaron:]

Attachment: debugging from hitting this on flickr

I just hit this loading https://www.flickr.com/photos/dbaron/

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/d3f70a7f2386