1322614 - Assertion failure: p, at js/src/vm/TraceLogging.cpp:287

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision c2526f6786f0 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// Adapted from randomly chosen test: js/src/jit-test/tests/tracelogger/bug1300515.js
var du = new Debugger();
du.setupTraceLoggerScriptCalls();
du.startTraceLogger();
for (var j = 0; j < 2; ++j) {
    // Adapted from randomly chosen test: js/src/jit-test/tests/sunspider/check-controlflow-recursive.js
    evaluate("\
        function f(x, y, z) {\
            if (y > x) return;\
            return (f(x - 1, y, z), f(y - 1, z, x), f(z - 1, x, y));\
        };\
        for (var i = 3; i < 5; i++) {\
            f(3 * i + 3, 2 * i + 2, 1);\
        };\
    ");
}


Backtrace:

0   js-dbg-64-dm-clang-darwin-c2526f6786f0	0x000000010db741e3 js::TraceLoggerThread::eventText(unsigned int) + 163 (TraceLogging.cpp:287)
1   js-dbg-64-dm-clang-darwin-c2526f6786f0	0x000000010db75f79 js::TraceLoggerThread::stopEvent(unsigned int) + 361 (TraceLogging.cpp:573)
2   ???                           	0x000000011c8fbc5d 0 + 4774149213
3   ???                           	0x000000010fcdec7d 0 + 4560120957
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9bf32cd7b3e5
user:        Hannes Verschore
date:        Fri Sep 02 18:19:27 2016 +0200
summary:     Bug 1298541: Tracelogger: Part 1: Add debugging to check start and stop correspond, r=bbouvier

Hannes, finally I think I got the right regressing changeset. :)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/edb24e0ff1e1
TraceLogging: Don't compare text strings when they are already flushed, r=bbouvier

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/edb24e0ff1e1