1586485 - Assertion failure: script->hasScriptCounts(), at js/src/vm/JSScript.cpp:1414

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 74c62117e3e5 (build with --enable-debug --enable-simulator=arm64, run with --fuzzing-safe --no-threads --ion-eager --dump-bytecode --nursery-strings=off):

See attachment.

Backtrace:

#0  GetScriptCountsMapEntry (script=<optimized out>) at js/src/vm/JSScript.cpp:1414
#1  0x0000559e87f53a57 in JSScript::getScriptCounts (this=0x7fdca4fe8570 <_IO_stdfile_2_lock>) at js/src/vm/JSScript.cpp:1421
#2  0x0000559e87f5436f in JSScript::maybeGetPCCounts (this=0xac3c4cb4700, pc=0x7fdca3c9bea6 "P\001") at js/src/vm/JSScript.cpp:1513
#3  0x0000559e87dad0a7 in DumpPCCounts (cx=<optimized out>, script=..., sp=0x559e892b32a0 <vtable for js::Sprinter+16>) at js/src/vm/BytecodeUtil.cpp:152
#4  js::DumpRealmPCCounts (cx=0x7fdca3c28000) at js/src/vm/BytecodeUtil.cpp:201
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/0d25043ccb59
user: Jan de Mooij
date: Fri Oct 04 15:03:57 2019 +0000
summary: Bug 1398738 - Discard ScriptCounts after discarding JitScript. r=nbp

Jan, is bug 1398738 a likely regressor?

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1586485 - Don't discard script counts on GC when --dump-bytecode is used. r?nbp!

Also ensure DumpPCCounts does not trigger GC and discard the script counts when
disassembling in debug builds.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/85a86e5a8815
Don't discard script counts on GC when --dump-bytecode is used. r=nbp

Comment 6

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/85a86e5a8815