1547179 - Assertion failure: collectCoverage(), at js/src/vm/Realm.cpp:341

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 7e40e33da3da (build with --enable-debug, run with --fuzzing-safe --no-threads --ion-eager --ion-pgo=off --gc-zeal=2 --dump-bytecode):

quit();

Backtrace:

#0 JS::Realm::traceRoots (this=0x7f0ae0553800, trc=0x7f0ae051c6d0, traceOrMark=<optimized out>) at js/src/vm/Realm.cpp:341
#1 0x0000557d5a590e9d in js::gc::GCRuntime::traceRuntimeCommon (this=<optimized out>, trc=0x7f0ae051c6d0, traceOrMark=js::gc::GCRuntime::MarkRuntime) at js/src/gc/RootMarking.cpp:383
#2 0x0000557d5a5906c2 in js::gc::GCRuntime::traceRuntimeForMajorGC (this=0x7f0ae051b6d8, trc=0x7f0ae051c6d0, session=...) at js/src/gc/RootMarking.cpp:285
#3 0x0000557d5a4f3c54 in js::gc::GCRuntime::beginMarkPhase (this=0x7f0ae051b6d8, reason=<optimized out>, session=...) at js/src/gc/GC.cpp:4407
#4 0x0000557d5a504f3d in js::gc::GCRuntime::incrementalSlice (this=0x7f0ae051b6d8, budget=..., reason=JS::GCReason::DEBUG_GC, session=...) at js/src/gc/GC.cpp:7024
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/24740ab9a726
user: Jan de Mooij
date: Thu Apr 25 13:35:55 2019 +0000
summary: Bug 1546934 - Change LCov code coverage machinery to use a process-wide flag. r=nbp

Jan, is bug 1546934 a likely regressor?

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1547179 - Remove an assertion that's no longer valid because rt->profilingScripts no longer implies IsLCovEnabled. r?nbp!

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 5

[Jason Orendorff [:jorendorff]]

Great test case :)

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dcdecf563747
Remove an assertion that's no longer valid because rt->profilingScripts no longer implies IsLCovEnabled. r=nbp

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/dcdecf563747
Remove an assertion that's no longer valid because rt->profilingScripts no longer implies IsLCovEnabled. r=nbp

Comment 8

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/dcdecf563747