1223767 - TraceLogger: Assertion failure: i < size_, at js/src/vm/TraceLoggingTypes.h:210

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Wei Wu [:wuwei UTC+8]]

> $TLLOG=Default,IonCompiler TLOPTIONS=EnableMainThread,EnableOffThread,EnableGraph ../_DBG.OBJ/dist/bin/js run.js                       
Richards: 1328
DeltaBlue: 2486
Crypto: 4523
RayTrace: 5180
EarleyBoyer: 1314
RegExp: 568
Splay: 1236
SplayLatency: 1310
NavierStokes: 36137
PdfJS: 1802
Mandreel: 6313
MandreelLatency: 8028
Gameboy: 5520
CodeLoad: 7968
Box2D: 2622
zlib: 72493
Typescript: 3496
----
Score (version 9): 3851
Assertion failure: i < size_, at /work/mozilla-central/js/src/vm/TraceLoggingTypes.h:210
Segmentation fault (core dumped)

---

(gdb) bt
#0  0x000000000042d994 in ContinuousSpace<TraceLoggerGraph::TreeEntry>::operator[] (i=<error reading variable: Cannot access memory at address 0x7ffec8335d08>, this=<error reading variable: Cannot access memory at address 0x7ffec8335d08>)
    at js/src/vm/TraceLoggingTypes.h:210
Cannot access memory at address 0x7ffec8335d08
(gdb) 

--

not very useful :-(

Comment 1

[Wei Wu [:wuwei UTC+8]]

MOZ_ASSERT(i < size_) when i == size_ == 0.

(gdb) bt
#0  0x000000000042df30 in ContinuousSpace<TraceLoggerGraph::TreeEntry>::operator[] (i=<optimized out>, 
    this=0x7ffff6925170) at js/src/vm/TraceLoggingTypes.h:210
#1  0x000000000055ad40 in operator[] (i=<optimized out>, this=0x7ffff6925170)
    at js/src/vm/TraceLoggingGraph.cpp:484
#2  TraceLoggerGraph::getTreeEntry (this=0x7ffff6925150, treeId=<optimized out>, entry=0x7fffffffd830)
    at js/src/vm/TraceLoggingGraph.cpp:470
#3  0x000000000055bb68 in TraceLoggerGraph::startEventInternal (this=this@entry=0x7ffff6925150, id=id@entry=14, 
    timestamp=timestamp@entry=41058445029) at js/src/vm/TraceLoggingGraph.cpp:356
#4  0x000000000055c409 in startEvent (timestamp=41058445029, id=14, this=0x7ffff6925150)
    at js/src/vm/TraceLoggingGraph.cpp:326
#5  TraceLoggerGraph::log (this=this@entry=0x7ffff6925150, events=...)
    at js/src/vm/TraceLoggingGraph.cpp:570
#6  0x0000000000555405 in js::TraceLoggerThread::~TraceLoggerThread (this=0x7ffff69861b0, __in_chrg=<optimized out>)
    at js/src/vm/TraceLogging.cpp:186
#7  0x00000000005554ee in js_delete<js::TraceLoggerThread> (p=0x7ffff69861b0) at ../../dist/include/js/Utility.h:370
#8  js::TraceLoggerThreadState::~TraceLoggerThreadState (this=0x7ffff69860e0, __in_chrg=<optimized out>)
    at js/src/vm/TraceLogging.cpp:580
#9  0x000000000055597d in js_delete<js::TraceLoggerThreadState> (p=0x7ffff69860e0)
    at ../../dist/include/js/Utility.h:370
#10 js::DestroyTraceLoggerThreadState () at js/src/vm/TraceLogging.cpp:126
#11 0x00000000005546f5 in JS_ShutDown () at js/src/vm/Initialization.cpp:130
#12 0x00000000004880d7 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>)
    at js/src/shell/js.cpp:6852

Comment 2

[Wei Wu [:wuwei UTC+8]]

Attachment: bug1223767.patch

Fixed.

Comment 3

[Wei Wu [:wuwei UTC+8]]

Attachment: bug1223767-rebased.patch

rebased.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ee9ff42466d0

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/ee9ff42466d0