1339944 - Assertion failure: cx->runtime()->activeContextChangeProhibited() || !cx->runtime()->gc.canChangeActiveContext(cx), at js/src/vm/Stack.cpp:1731

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision ec3ef9f77a52 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

See attachment.

Backtrace:

#0  js::ActivationIterator::ActivationIterator (this=0x7ffe4670dcc0, cx=0x7f0c06b4b000, target=...) at js/src/vm/Stack.cpp:1730
#1  0x000000000069a9fb in js::jit::JitActivationIterator::JitActivationIterator (target=..., cx=<optimized out>, this=0x7ffe4670dcc0) at js/src/vm/Stack.h:1645
#2  js::jit::InvalidateAll (fop=fop@entry=0x7f0c06b271d0, zone=zone@entry=0x7f0c05c31000) at js/src/jit/Ion.cpp:3208
#3  0x0000000000de9ebb in JS::Zone::discardJitCode (this=0x7f0c05c31000, fop=0x7f0c06b271d0, discardBaselineCode=discardBaselineCode@entry=false) at js/src/gc/Zone.cpp:235
#4  0x0000000000c18a2a in js::AutoClearTypeInferenceStateOnOOM::~AutoClearTypeInferenceStateOnOOM (this=0x7ffe4670de88, __in_chrg=<optimized out>) at js/src/vm/TypeInference.cpp:4603
/snip

For detailed crash information, see attachment.

This testcase when reduced seems fragile, so filing this while it is fairly reproducible.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/fe2fedb64403
user:        Brian Hackett
date:        Thu Feb 09 05:41:31 2017 -0700
summary:     Bug 1335095 - Allow cooperating JSContexts to iterate over each others' activations, r=jandem.

Brian, is bug 1335095 a likely regressor?

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Error: Failed to isolate test from comment

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3ebbc022b8f6
Prohibit context switches while handling OOM during type inference operations, r=jandem.

Comment 7

[Christian Holler (:decoder)]

Probably the same as bug 1341283 but that bug has a simple test case.

Comment 8

[Brian Hackett [Laid off!]]

Bug 1341283 is actually a separate issue.

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3ebbc022b8f6