1111506 - Assertion failure: inited == !getPrototype(key).isUndefined(), at vm/GlobalObject.h

Status: RESOLVED DUPLICATE of bug 1101561

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

This testcase asserts js debug shell on m-c changeset f14dcd1c8c0b with --fuzzing-safe --no-asmjs --baseline-eager --no-ion --no-threads at Assertion failure: inited == !getPrototype(key).isUndefined(), at vm/GlobalObject.h.

(Please remember to first change the path to your m-c repo first)

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/ba17a7e1ae7b
user:        Hannes Verschore
date:        Thu Nov 20 17:44:02 2014 +0100
summary:     Bug 1072910 - TraceLogger: Create hooks for the debugger, r=bbouvier

Not sure, if bug 1072910 is the regressor, or if it merely exposed this issue. Hannes, thoughts?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x3c10e8, 0x000000010050109c js-dbg-opt-64-dm-nsprBuild-darwin-f14dcd1c8c0b`js::GlobalObject::functionObjectClassesInitialized() const [inlined] js::NativeObject::getSlot(this=<unavailable>, slot=<unavailable>) const + 28 at NativeObject.h:740, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x000000010050109c js-dbg-opt-64-dm-nsprBuild-darwin-f14dcd1c8c0b`js::GlobalObject::functionObjectClassesInitialized() const [inlined] js::NativeObject::getSlot(this=<unavailable>, slot=<unavailable>) const + 28 at NativeObject.h:740
    frame #1: 0x0000000100501080 js-dbg-opt-64-dm-nsprBuild-darwin-f14dcd1c8c0b`js::GlobalObject::functionObjectClassesInitialized() const [inlined] js::GlobalObject::getConstructor(this=<unavailable>, key=<unavailable>) const at GlobalObject.h:147
    frame #2: 0x0000000100501080 js-dbg-opt-64-dm-nsprBuild-darwin-f14dcd1c8c0b`js::GlobalObject::functionObjectClassesInitialized() const [inlined] js::GlobalObject::classIsInitialized(this=<unavailable>, key=<unavailable>) const at GlobalObject.h:183
    frame #3: 0x0000000100501080 js-dbg-opt-64-dm-nsprBuild-darwin-f14dcd1c8c0b`js::GlobalObject::functionObjectClassesInitialized(this=<unavailable>) const + 448 at GlobalObject.h:189
    frame #4: 0x00000001004d8216 js-dbg-opt-64-dm-nsprBuild-darwin-f14dcd1c8c0b`js::GlobalObject::getOrCreateObjectPrototype(this=0x00000001049ed060, cx=0x0000000101b14530) + 22 at GlobalObject.h:296
(lldb)

Comment 2

[Hannes Verschore [:h4writer]]

Gary, all these patches are backed out. Can you check if it is still an issue?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Hannes Verschore [:h4writer] from comment #2)
> Gary, all these patches are backed out. Can you check if it is still an
> issue?

I'm fairly sure it is. Like I said, this is likely an OOM issue, so the bisection might not be accurate, thus please feel free to forward this to someone else.

Comment 4

[Hannes Verschore [:h4writer]]

I tried to reproduce this, but I didn't succeed.
@Jan: any clues on how to proceed with this?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've sent files to Hannes and Jan, hopefully someone can reproduce.

Comment 6

[Jan de Mooij [:jandem]]

I can reproduce this. It's probably very similar to bug 1101561, but this time it's another constructor/prototype.

The initialization code assumes when one thing is initialized another one has also been initialized, but this easily breaks when we OOM :(

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting needinfo? from :Waldo since he is set needinfo?'ed on bug 1101561. :D

I'll also forward files to him.