Closed Bug 1064159 Opened 10 years ago Closed 10 years ago

Shumway hits SpiderMonkey assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Tracking

()

Status:

RESOLVED FIXED

Milestone:

mozilla35

Tracking Flags:

Tracking

Status

firefox34

---

unaffected

firefox35

---

affected

People

(Reporter: cpeterson, Assigned: bhackett1024)

References

Details

(Keywords: assertion, regression, reproducible)

Attachments

(2 files)

patch 10 years ago Brian Hackett [Laid off!] 1.05 KB, patch	jandem : review+	Details \| Diff \| Splinter Review
debugging from hitting this on flickr 10 years ago David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla) 95.68 KB, text/plain		Details

Comment hidden (obsolete)

This assertion failure (from bug 618690) started when the new (TypeScript) version of Shumway was merged to mozilla-central by bug 1061888 on 2014-08-05. STR: 1. Enable Shumway by flipping about:config pref "shumway.disabled" to false. 2. Running a debug build, load Flash site http://www.zombo.com RESULT: Assertion failure: !unknownProperties(), at /builds/slave/m-cen-osx64-d-0000000000000000/build/js/src/jsinferinlines.h:1234 Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000 0x000000010465187c in js_GetScriptLineExtent () (gdb) bt #0 0x000000010465187c in js_GetScriptLineExtent () #1 0x00000001045c2630 in JS::GetGCNumber () #2 0x00000001045c285e in JS::GetGCNumber () #3 0x00000001045e5d52 in JS_CopyPropertiesFrom () #4 0x00000001045e5944 in JS_CopyPropertiesFrom () #5 0x000000010465a9ed in js_GetScriptLineExtent () #6 0x000000010473ab36 in js::ProfilingGetPC () #7 0x00000001043173e0 in JS::HeapCellRelocate () #8 0x00000001000edd33 in ?? () #9 0x00000001253bab8c in ?? () #10 0x00000001367e9f60 in ?? () #11 0x0000000113b0442c in ?? () #12 0x0000000134bda358 in ?? () #13 0x00000001000e4940 in ?? () #14 0x00000001043288fb in JS::HeapCellRelocate () #15 0x00000001043283b2 in JS::HeapCellRelocate () #16 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #17 0x000000010471e2bb in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #18 0x000000010471f1b8 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #19 0x000000010471f417 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #20 0x000000010431cf0c in JS::HeapCellRelocate () #21 0x00000001000edb63 in ?? () #22 0x0000000135bdc820 in ?? () #23 0x00000001000e4940 in ?? () #24 0x00000001043288fb in JS::HeapCellRelocate () #25 0x00000001043283b2 in JS::HeapCellRelocate () #26 0x0000000104717dde in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #27 0x000000010470e9b4 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #28 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #29 0x000000010471eb6f in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #30 0x000000010431cff6 in JS::HeapCellRelocate () #31 0x00000001000edb63 in ?? () #32 0x0000000135bf9220 in ?? () #33 0x0000000113b0442c in ?? () #34 0x00000001359cbb80 in ?? () #35 0x00000001000e4940 in ?? () #36 0x00000001043288fb in JS::HeapCellRelocate () #37 0x00000001043283b2 in JS::HeapCellRelocate () #38 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #39 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #40 0x00000001045a1c89 in JS::CompileOptions::CompileOptions () #41 0x00000001253b06e8 in ?? () #42 0x0000000134af1590 in ?? () #43 0x00000001000e4940 in ?? () #44 0x00000001043288fb in JS::HeapCellRelocate () #45 0x00000001043283b2 in JS::HeapCellRelocate () #46 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #47 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #48 0x00000001045a1c89 in JS::CompileOptions::CompileOptions () #49 0x00000001253b06e8 in ?? () #50 0x00000001359c6a98 in ?? () #51 0x0000000113b0442c in ?? () #52 0x00000001359c6e20 in ?? () #53 0x0000000113b0442c in ?? () #54 0x00000001359cbb80 in ?? () #55 0x00000001000e4940 in ?? () #56 0x00000001043288fb in JS::HeapCellRelocate () #57 0x00000001043283b2 in JS::HeapCellRelocate () #58 0x000000010470e984 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #59 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #60 0x00000001045a1c89 in JS::CompileOptions::CompileOptions () #61 0x00000001253b06e8 in ?? () #62 0x0000000134af1590 in ?? () #63 0x00000001000e4940 in ?? () #64 0x00000001043288fb in JS::HeapCellRelocate () #65 0x00000001043283b2 in JS::HeapCellRelocate () #66 0x0000000104717dde in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #67 0x000000010470e9b4 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #68 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #69 0x00000001045a35dc in JS::CompileOptions::CompileOptions () #70 0x0000000104739fe2 in js::ProfilingGetPC () #71 0x000000010471e32d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #72 0x00000001045a153c in JS::CompileOptions::CompileOptions () #73 0x0000000104739fe2 in js::ProfilingGetPC () #74 0x000000010471e32d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #75 0x0000000104717a3f in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #76 0x000000010470e9b4 in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #77 0x000000010471e33d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #78 0x00000001045a35dc in JS::CompileOptions::CompileOptions () #79 0x0000000104739fe2 in js::ProfilingGetPC () #80 0x000000010471e32d in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #81 0x000000010471eb6f in js::SecurityWrapper<js::CrossCompartmentWrapper>::unwatch () #82 0x0000000104534f8b in JS::CompileOptions::CompileOptions () #83 0x000000010233134b in js::BaseProxyHandler::finalizeInBackground () #84 0x000000010209cbc6 in imgLoader::SupportImageWithMimeType () #85 0x000000010208247a in imgLoader::SupportImageWithMimeType () #86 0x0000000102074a65 in imgLoader::SupportImageWithMimeType () #87 0x0000000102081fd7 in imgLoader::SupportImageWithMimeType () #88 0x00000001014d97b8 in XRE_AddJarManifestLocation () #89 0x00000001014d9aa0 in XRE_AddJarManifestLocation () #90 0x00000001014d4e94 in XRE_AddJarManifestLocation () #91 0x00000001014ffb9d in nsXPTCStubBase::Stub249 () #92 0x0000000102c83547 in mac_plugin_interposing_child_OnShowCursor () #93 0x0000000102cd86ce in mac_plugin_interposing_child_OnShowCursor () #94 0x00007fff8cff65b1 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ () #95 0x00007fff8cfe7c62 in __CFRunLoopDoSources0 () #96 0x00007fff8cfe73ef in __CFRunLoopRun () #97 0x00007fff8cfe6e75 in CFRunLoopRunSpecific () #98 0x00007fff86645a0d in RunCurrentEventLoopInMode () #99 0x00007fff866457b7 in ReceiveNextEventCommon () #100 0x00007fff866455bc in _BlockUntilNextEventMatchingListInModeWithFilter () #101 0x00007fff9223f24e in _DPSNextEvent () #102 0x00007fff9223e89b in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #103 0x0000000102cd7bc6 in mac_plugin_interposing_child_OnShowCursor () #104 0x00007fff9223299c in -[NSApplication run] () #105 0x0000000102cd8d86 in mac_plugin_interposing_child_OnShowCursor () #106 0x0000000103b403a2 in XRE_StartupTimelineRecord () #107 0x0000000103ba556f in XRE_InitCommandLine () #108 0x0000000103ba5c19 in XRE_InitCommandLine () #109 0x0000000103ba5fce in XRE_main () #110 0x00000001000022ac in start () (gdb)

Chris Peterson [:cpeterson]

Reporter

Comment 1

•

10 years ago

Brian: this assertion failure is a regression from your "Singleton type set fix" bug 1041688 comment 40: https://hg.mozilla.org/integration/mozilla-inbound/rev/7b20a4e9ce15 I saw hits assertion failure after the new (TypeScript) version of Shumway was merged to mozilla-central on 2014-08-05 (bug 1061888). STR: 1. Enable Shumway by flipping about:config pref "shumway.disabled" to false. 2. Running a debug build, load Flash site http://www.zombo.com RESULT: Assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Blocks: 1041688
No longer blocks: 618690

Flags: needinfo?(bhackett1024)

Keywords: regression

Chris Peterson [:cpeterson]

Reporter

Updated

•

10 years ago

status-firefox34: --- → unaffected

Summary: Shumway hits assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234 → Shumway hits SpiderMonkey assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Brian Hackett [Laid off!]

Assignee

Comment 2

•

10 years ago

Attached patch patch — Details — Splinter Review

The APIs for updating type properties are pretty convoluted and after this lands I'll write a patch to clean them up.

Assignee: nobody → bhackett1024

Attachment #8487943 - Flags: review?(jdemooij)

Flags: needinfo?(bhackett1024)

Jan de Mooij [:jandem]

Updated

•

10 years ago

Attachment #8487943 - Flags: review?(jdemooij) → review+

Brian Hackett [Laid off!]

Assignee

Comment 3

•

10 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/d3f70a7f2386

Brian Hackett [Laid off!]

Assignee

Updated

•

10 years ago

Blocks: 1066652

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Comment 4

•

10 years ago

Attached file debugging from hitting this on flickr — Details

I just hit this loading https://www.flickr.com/photos/dbaron/

Phil Ringnalda (:philor)

Comment 5

•

10 years ago

https://hg.mozilla.org/mozilla-central/rev/d3f70a7f2386

Status: NEW → RESOLVED

Closed: 10 years ago

Resolution: --- → FIXED

Target Milestone: --- → mozilla35

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Shumway hits SpiderMonkey assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Categories

(Core :: JavaScript Engine, defect)

Tracking

()

People

(Reporter: cpeterson, Assigned: bhackett1024)

References

Details

(Keywords: assertion, regression, reproducible)

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Updated

Comment 2

Updated

Comment 3

Updated

Comment 4

Comment 5

Attachment

General

Description

File Name

Content Type