Assertion failure: p, at js/src/vm/TraceLogging.cpp:287

RESOLVED FIXED in Firefox 53

Status

()

defect
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks 2 bugs, {assertion, jsbugmon, testcase})

Trunk
mozilla53
x86_64
macOS
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox53 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

Reporter

Description

3 years ago
The following testcase crashes on mozilla-central revision c2526f6786f0 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// Adapted from randomly chosen test: js/src/jit-test/tests/tracelogger/bug1300515.js
var du = new Debugger();
du.setupTraceLoggerScriptCalls();
du.startTraceLogger();
for (var j = 0; j < 2; ++j) {
    // Adapted from randomly chosen test: js/src/jit-test/tests/sunspider/check-controlflow-recursive.js
    evaluate("\
        function f(x, y, z) {\
            if (y > x) return;\
            return (f(x - 1, y, z), f(y - 1, z, x), f(z - 1, x, y));\
        };\
        for (var i = 3; i < 5; i++) {\
            f(3 * i + 3, 2 * i + 2, 1);\
        };\
    ");
}


Backtrace:

0   js-dbg-64-dm-clang-darwin-c2526f6786f0	0x000000010db741e3 js::TraceLoggerThread::eventText(unsigned int) + 163 (TraceLogging.cpp:287)
1   js-dbg-64-dm-clang-darwin-c2526f6786f0	0x000000010db75f79 js::TraceLoggerThread::stopEvent(unsigned int) + 361 (TraceLogging.cpp:573)
2   ???                           	0x000000011c8fbc5d 0 + 4774149213
3   ???                           	0x000000010fcdec7d 0 + 4560120957
/snip

For detailed crash information, see attachment.
Reporter

Comment 2

3 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9bf32cd7b3e5
user:        Hannes Verschore
date:        Fri Sep 02 18:19:27 2016 +0200
summary:     Bug 1298541: Tracelogger: Part 1: Add debugging to check start and stop correspond, r=bbouvier

Hannes, finally I think I got the right regressing changeset. :)
Blocks: 1298541

Comment 3

3 years ago
Pushed by hv1989@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/edb24e0ff1e1
TraceLogging: Don't compare text strings when they are already flushed, r=bbouvier
Duplicate of this bug: 1322613

Comment 5

3 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/edb24e0ff1e1
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
You need to log in before you can comment on or make changes to this bug.