1187123 - Assertion failure: (l.asBits >> 47) <= JSVAL_TAG_OBJECT, at dist/include/js/Value.h

Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)

Reporter

Description

•

9 years ago

try {
    x = evalcx("lazy");
    for (var p in p1) {}
} catch (e) {}
try {
    x.e
} catch (e) {}
try {
    new n({})
} catch (e) {}
try {
    x.eval("t()")
} catch (e) {}

asserts js debug shell on m-c changeset eee2d49d055c with --fuzzing-safe --gc-zeal=14 --no-threads --baseline-eager at Assertion failure: (l.asBits >> 47) <= JSVAL_TAG_OBJECT, at dist/include/js/Value.h

Configure options:

AR=ar sh /home/gkwong/trees/mozilla-central/js/src/configure --enable-debug --disable-threadsafe --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r eee2d49d055c

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/fa9fe193778f
user:        Tom Tromey
date:        Fri Jul 17 07:48:00 2015 -0400
summary:     Bug 1148593 - Create async stack in callback objects. r=bz, r=fitzgen

This was tested to occur on Ubuntu 12.04.5 LTS.

Boris/Nick, is bug 1148593 a likely regressor, or did it merely expose the bug?

Flags: needinfo?(nfitzgerald)

Flags: needinfo?(bzbarsky)

Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)

Reporter

Comment 1

•

9 years ago

Attached file stack — Details

(gdb) bt 5
warning: (Internal error: pc 0x6179c7 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x6179c7 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x6179c7 in read in psymtab, but not in symtab.)

#0  0x00000000006179c7 in _ZN2js18DispatchValueTypedI16DoMarkingFunctorIN2JS5ValueEEJRPNS_8GCMarkerEEEEDTclfp_scP8JSObjectLDn0Espcl7ForwardIT0_Efp1_EEET_RKS3_DpOSA_ () at ../../dist/include/js/Value.h:804
warning: (Internal error: pc 0x61a3b3 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x61a370 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x61a3b3 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x61a3b4 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x61a3b3 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x61a3b3 in read in psymtab, but not in symtab.)

#1  0x000000000061a3b4 in void DispatchToTracer<JS::Value>(JSTracer*, JS::Value*, char const*) ()
    at /home/gkwong/trees/mozilla-central/js/src/gc/Marking.cpp:674
warning: (Internal error: pc 0x843551 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x843200 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x843551 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x843552 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x843551 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x843551 in read in psymtab, but not in symtab.)

#2  0x0000000000843552 in js::jit::BaselineFrame::trace(JSTracer*, js::jit::JitFrameIterator&) ()
    at /home/gkwong/trees/mozilla-central/js/src/jit/BaselineFrame.cpp:53
warning: (Internal error: pc 0x92ec42 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x92e7a0 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x92ec42 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x92ec43 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x92ec42 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x92ec42 in read in psymtab, but not in symtab.)

#3  0x000000000092ec43 in js::jit::MarkJitActivations(JSRuntime*, JSTracer*) ()
    at /home/gkwong/trees/mozilla-central/js/src/jit/JitFrames.cpp:1541
warning: (Internal error: pc 0x7fc12f in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x7fbb90 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x7fc12f in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x7fc130 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x7fc12f in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x7fc12f in read in psymtab, but not in symtab.)

#4  0x00000000007fc130 in js::gc::GCRuntime::markRuntime(JSTracer*, js::gc::GCRuntime::TraceOrMarkRuntime, js::gc::GCRuntime::TraceRootsOrUsedSaved) () at /home/gkwong/trees/mozilla-central/js/src/gc/RootMarking.cpp:424
(More stack frames follow...)
warning: (Internal error: pc 0x6179c7 in read in psymtab, but not in symtab.)

(gdb)

Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]

Comment 2

•

9 years ago

It doesn't seem like a very likely regressor to me... Although I guess the testcase does create error objects, which capture stacks, which that bug touches a little... Seems like a little bit of a stretch though.

ni? tromey to come properly figure out if this is caused or exposed here.

Flags: needinfo?(nfitzgerald) → needinfo?(ttromey)

Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)

Reporter

Comment 3

•

9 years ago

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8d2d0a61f5df
user:        Terrence Cole
date:        Thu Jul 09 08:45:42 2015 -0700
summary:     Bug 1181292 - Make JSPropertyDescriptor a StaticTraceable; r=efaust

I've had other bisection results leading to bug 1181292.

Maybe Terrence also might know what's going on?

Flags: needinfo?(terrence)

Boris Zbarsky [:bzbarsky]

Comment 4

•

9 years ago

Given the stack, my money is on GC changes here, so terrence.

Flags: needinfo?(bzbarsky)

Tom Tromey :tromey

Comment 5

•

9 years ago

(In reply to Nick Fitzgerald [:fitzgen][:nf] from comment #2)
> It doesn't seem like a very likely regressor to me... Although I guess the
> testcase does create error objects, which capture stacks, which that bug
> touches a little... Seems like a little bit of a stretch though.
> 
> ni? tromey to come properly figure out if this is caused or exposed here.

The patch in question was backed out for other reasons and hasn't gone back in yet.
So if the bug is visible with any head revision, then it can't be due to that patch.

Flags: needinfo?(ttromey)

Tom Tromey :tromey

Updated

•

9 years ago

No longer blocks: 1148593

Terrence Cole [:terrence]

Comment 6

•

9 years ago

A busted Value coming out of BaselineFrame::trace. Eric, were you able to reproduce this?

Flags: needinfo?(terrence) → needinfo?(efaustbmo)

Christian Holler (:decoder)

Comment 7

•

9 years ago

This is an automated crash issue comment:

Summary: Assertion failure: (l.asBits >> 47) <= JSVAL_TAG_OBJECT, at ../../dist/include/js/Value.h:804
Build version: mozilla-central-patch revision 80441b5a95c1
Build flags: --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug
Runtime options: --no-threads --baseline-eager min.js

Testcase:

var g = newGlobal();
var N = 4;
for (var i = 0; i < N; i++) {
    var dbg = Debugger(g);
    dbg.onDebuggerStatement = function (frame) {};
    g.eval('debugger;');
    gc();
}


Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000000000061b458 in JSVAL_IS_OBJECT_IMPL (l=...) at ../../dist/include/js/Value.h:804
#0  0x000000000061b458 in JSVAL_IS_OBJECT_IMPL (l=...) at ../../dist/include/js/Value.h:804
#1  isObject (this=0x7fffffffc0c8) at ../../dist/include/js/Value.h:1142
#2  js::TenuringTracer::traverse<JS::Value> (this=<optimized out>, valp=0x7fffffffc0c8) at js/src/gc/Marking.cpp:1874
#3  0x00000000006533b5 in DispatchToTracer<JS::Value> (trc=<optimized out>, thingp=<optimized out>, name=<optimized out>) at js/src/gc/Marking.cpp:595
#4  0x000000000086e3b2 in js::jit::BaselineFrame::trace (this=0x7fffffffc058, trc=trc@entry=0x7fffffffa990, frameIterator=...) at js/src/jit/BaselineFrame.cpp:53
#5  0x0000000000952a63 in MarkJitActivation (activations=..., trc=<optimized out>) at js/src/jit/JitFrames.cpp:1541
#6  js::jit::MarkJitActivations (rt=<optimized out>, trc=trc@entry=0x7fffffffa990) at js/src/jit/JitFrames.cpp:1576
#7  0x0000000000829350 in js::gc::GCRuntime::markRuntime (this=this@entry=0x7ffff6937348, trc=trc@entry=0x7fffffffa990, traceOrMark=traceOrMark@entry=js::gc::GCRuntime::TraceRuntime, rootsSource=rootsSource@entry=js::gc::GCRuntime::TraceRoots) at js/src/gc/RootMarking.cpp:430
#8  0x0000000000845054 in js::Nursery::collect (this=this@entry=0x7ffff69373a0, rt=0x7ffff6937000, reason=reason@entry=JS::gcreason::EVICT_NURSERY, pretenureGroups=pretenureGroups@entry=0x0) at js/src/gc/Nursery.cpp:453
#9  0x0000000000b2fdf5 in js::gc::GCRuntime::minorGCImpl (this=this@entry=0x7ffff6937348, reason=reason@entry=JS::gcreason::EVICT_NURSERY, pretenureGroups=pretenureGroups@entry=0x0) at js/src/jsgc.cpp:6443
#10 0x0000000000638dd8 in js::gc::GCRuntime::evictNursery (this=0x7ffff6937348, reason=JS::gcreason::EVICT_NURSERY) at js/src/gc/GCRuntime.h:610
#11 0x00000000008f2746 in js::jit::RecompileOnStackBaselineScriptsForDebugMode (cx=cx@entry=0x7ffff6906800, obs=..., observing=observing@entry=js::Debugger::Observing) at js/src/jit/BaselineDebugModeOSR.cpp:860
#12 0x0000000000672316 in js::Debugger::updateExecutionObservabilityOfFrames (cx=cx@entry=0x7ffff6906800, obs=..., observing=js::Debugger::Observing) at js/src/vm/Debugger.cpp:1993
#13 0x0000000000672524 in js::Debugger::ensureExecutionObservabilityOfFrame (cx=cx@entry=0x7ffff6906800, frame=...) at js/src/vm/Debugger.cpp:2170
#14 0x000000000069595a in js::Debugger::getScriptFrameWithIter (this=this@entry=0x7ffff6969000, cx=cx@entry=0x7ffff6906800, frame=..., maybeIter=maybeIter@entry=0x7fffffffb950, vp=..., vp@entry=...) at js/src/vm/Debugger.cpp:480
#15 0x00000000006bdf4b in getScriptFrame (vp=..., iter=..., cx=0x7ffff6906800, this=0x7ffff6969000) at js/src/vm/Debugger.h:861
#16 js::Debugger::fireDebuggerStatement (this=this@entry=0x7ffff6969000, cx=cx@entry=0x7ffff6906800, vp=..., vp@entry=...) at js/src/vm/Debugger.cpp:1185
#17 0x00000000006be403 in operator() (dbg=0x7ffff6969000, __closure=<synthetic pointer>) at js/src/vm/Debugger.cpp:697
#18 dispatchHook<js::Debugger::slowPathOnDebuggerStatement(JSContext*, js::AbstractFramePtr)::__lambda2, js::Debugger::slowPathOnDebuggerStatement(JSContext*, js::AbstractFramePtr)::__lambda3> (fireHook=..., cx=0x7ffff6906800, hookIsEnabled=...) at js/src/vm/Debugger.cpp:1392
#19 js::Debugger::slowPathOnDebuggerStatement (cx=cx@entry=0x7ffff6906800, frame=...) at js/src/vm/Debugger.cpp:698
#20 0x0000000000a77014 in onDebuggerStatement (frame=..., cx=0x7ffff6906800) at js/src/vm/Debugger-inl.h:50
#21 js::jit::OnDebuggerStatement (cx=0x7ffff6906800, frame=0x7fffffffc058, pc=<optimized out>, mustReturn=0x7fffffffc01c) at js/src/jit/VMFunctions.cpp:936
#22 0x00007ffff7e567ef in ?? ()
[...]
#38 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7fffffffc0c8	140737488339144
rcx	0x7ffff6ca5870	140737333844080
rdx	0x0	0
rsi	0x7ffff6f7a9d0	140737336814032
rdi	0x7ffff6f791c0	140737336807872
rbp	0x7fffffffa3e0	140737488331744
rsp	0x7fffffffa3c0	140737488331712
r8	0x7ffff7fe8780	140737354041216
r9	0x4156534a203d3c20	4708042038296001568
r10	0x7fffffffa180	140737488331136
r11	0x7ffff6c27ee0	140737333329632
r12	0x1b42540	28583232
r13	0x7fffffffa540	140737488332096
r14	0x7fffffffa510	140737488332048
r15	0x7fffffffa990	140737488333200
rip	0x61b458 <js::TenuringTracer::traverse<JS::Value>(JS::Value*)+136>
=> 0x61b458 <js::TenuringTracer::traverse<JS::Value>(JS::Value*)+136>:	movl   $0x324,0x0
   0x61b463 <js::TenuringTracer::traverse<JS::Value>(JS::Value*)+147>:	callq  0x4993c0 <abort()>

Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)

Reporter

Comment 8

•

9 years ago

:decoder and I agree that we can no longer reproduce the testcases here, so resolving WFM. We can file new bugs as they appear in the future.

Status: NEW → RESOLVED

Closed: 9 years ago

Flags: needinfo?(efaustbmo)

Resolution: --- → WORKSFORME

Bugzilla

Quick Search

Assertion failure: (l.asBits >> 47) <= JSVAL_TAG_OBJECT, at dist/include/js/Value.h

Categories

(Core :: JavaScript Engine, defect)

Tracking

()

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Updated

Comment 6

Comment 7

Comment 8

Attachment

General

Description

File Name

Content Type