Assertion failure: cx->runtime()->activeContextChangeProhibited() || !cx->runtime()->gc.canChangeActiveContext(cx), at js/src/vm/Stack.cpp:1731

RESOLVED FIXED in Firefox 54

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
11 months ago
11 months ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {assertion, jsbugmon, testcase})

Trunk
mozilla54
x86_64
Linux
assertion, jsbugmon, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox52 unaffected, firefox53 unaffected, firefox54 fixed)

Details

(Whiteboard: [jsbugmon:])

Attachments

(3 attachments)

(Reporter)

Description

11 months ago
The following testcase crashes on mozilla-central revision ec3ef9f77a52 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

See attachment.

Backtrace:

#0  js::ActivationIterator::ActivationIterator (this=0x7ffe4670dcc0, cx=0x7f0c06b4b000, target=...) at js/src/vm/Stack.cpp:1730
#1  0x000000000069a9fb in js::jit::JitActivationIterator::JitActivationIterator (target=..., cx=<optimized out>, this=0x7ffe4670dcc0) at js/src/vm/Stack.h:1645
#2  js::jit::InvalidateAll (fop=fop@entry=0x7f0c06b271d0, zone=zone@entry=0x7f0c05c31000) at js/src/jit/Ion.cpp:3208
#3  0x0000000000de9ebb in JS::Zone::discardJitCode (this=0x7f0c05c31000, fop=0x7f0c06b271d0, discardBaselineCode=discardBaselineCode@entry=false) at js/src/gc/Zone.cpp:235
#4  0x0000000000c18a2a in js::AutoClearTypeInferenceStateOnOOM::~AutoClearTypeInferenceStateOnOOM (this=0x7ffe4670de88, __in_chrg=<optimized out>) at js/src/vm/TypeInference.cpp:4603
/snip

For detailed crash information, see attachment.

This testcase when reduced seems fragile, so filing this while it is fairly reproducible.
(Reporter)

Comment 1

11 months ago
Created attachment 8837786 [details]
Detailed Crash Information
(Reporter)

Comment 2

11 months ago
Created attachment 8837787 [details]
Testcase
(Reporter)

Comment 3

11 months ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/fe2fedb64403
user:        Brian Hackett
date:        Thu Feb 09 05:41:31 2017 -0700
summary:     Bug 1335095 - Allow cooperating JSContexts to iterate over each others' activations, r=jandem.

Brian, is bug 1335095 a likely regressor?
Blocks: 1335095
Flags: needinfo?(bhackett1024)

Updated

11 months ago
Whiteboard: [jsbugmon:update] → [jsbugmon:]

Comment 4

11 months ago
JSBugMon: Cannot process bug: Error: Failed to isolate test from comment
(Assignee)

Comment 5

11 months ago
Created attachment 8839116 [details] [diff] [review]
patch
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8839116 - Flags: review?(jdemooij)

Updated

11 months ago
Attachment #8839116 - Flags: review?(jdemooij) → review+

Comment 6

11 months ago
Pushed by bhackett@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3ebbc022b8f6
Prohibit context switches while handling OOM during type inference operations, r=jandem.
Probably the same as bug 1341283 but that bug has a simple test case.
Blocks: 1341283
(Assignee)

Comment 8

11 months ago
Bug 1341283 is actually a separate issue.
No longer blocks: 1341283

Comment 9

11 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/3ebbc022b8f6
Status: NEW → RESOLVED
Last Resolved: 11 months ago
status-firefox54: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
status-firefox52: --- → unaffected
status-firefox53: --- → unaffected
You need to log in before you can comment on or make changes to this bug.