1094827 - Assertion failure in JSScript::maybeSweepTypes

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Jon Coppeard (:jonco)]

Attachment: patch.txt

Building with the attached patch and running:

JS_GC_ZEAL=14 gdb --args $JS/dist/bin/js jit-test/tests/debug/bug999655.js

Yields the following assertion:

Assertion failure: zone()->isGCSweepingOrCompacting() at js/src/jsinfer.cpp:4971

There doesn't appear to be anything in patch that could trigger this.

Comment 1

[Jon Coppeard (:jonco)]

Attachment: Stack backtrace

Comment 2

[Jon Coppeard (:jonco)]

This looks like it's related to incremental sweeping of type objects.  Brian, could you take a look?

Comment 3

[Brian Hackett [Laid off!]]

What platform is this?  I can't reproduce this.

Comment 4

[Hannes Verschore [:h4writer]]

I could only reproduce on linux x64

Comment 5

[Hannes Verschore [:h4writer]]

../configure --enable-debug --enable-optimize --enable-threadsafe --enable-build-nspr --enable-trace-malloc --disable-shared-js --enable-exact-rooting --enable-gccompacting

as configure flag

Comment 6

[Brian Hackett [Laid off!]]

Attachment: fix

This is a regression from bug 999655, actually.  When we analyze arguments usage from the debugger we end up analyzing a script in a different compartment from the one the context is in.

Comment 7

[Jason Orendorff [:jorendorff]]

Comment on attachment 8518339 [details] [diff] [review]
fix

Yep.

Comment 8

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2f20fe00845d

Comment 9

[Brian Hackett [Laid off!]]

And a followup since I forgot to add the second argument to AutoCompartment (I did test this patch, but on a different computer.)

https://hg.mozilla.org/integration/mozilla-inbound/rev/02f36604f77b

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2f20fe00845d
https://hg.mozilla.org/mozilla-central/rev/02f36604f77b

Comment 11

[Hannes Verschore [:h4writer]]

I now see:

TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/basic/bug656261.js | Timeout (code -9, args "--ion-eager --ion-offthread-compile=off")
TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/basic/bug656261.js | Timeout (code -9, args "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --no-sse3 --no-threads")
TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/gc/bug-975959.js | Assertion failure: activeParallelEntryScripts_ && activeParallelEntryScripts_->has(script), at /builds/slave/try_l64-d_sm-ggc-0000000000000/src/js/src/jit/Ion.cpp:557 (code -11, args "--ion-eager --ion-offthread-compile=off")
INFO stderr 2> Assertion failure: activeParallelEntryScripts_ && activeParallelEntryScripts_->has(script), at /builds/slave/try_l64-d_sm-ggc-0000000000000/src/js/src/jit/Ion.cpp:557
make[1]: *** [check-jit-test] Error 2
make: *** [check-jit-test] Error 2 

https://treeherder.mozilla.org/ui/logviewer.html#?job_id=3052525&repo=try

Is this related, or is this another bug?