1901407 - Assertion failure: this->flags() == 0, at /root/src/js/src/gc/Cell.h:798

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

This bug seems to be flakey and does not trigger every time on my machine.

Checkout commit 15778b8c32f8535624fff2af36fc669e65a9af3 and invoke the js shell as follows:

/root/js-spidermonkey-shell  --fast-warmup --ion-check-range-analysis --ion-extra-checks --fuzzing-safe --disable-oom-functions --enable-new-set-methods --small-function-length=2048 --inlining-entry-threshold=16 --gc-zeal=10,90 --ion-scalar-replacement=on --ion-pruning=off --ion-range-analysis=off --ion-inlining=on --ion-gvn=on --ion-osr=off --ion-edgecase-analysis=on --spectre-mitigations=on --ion-limit-script-size=on --ion-offthread-compile=off --ion-optimize-gcbarriers=on --ion-iterator-indices=off --no-ggc --ion-optimize-shapeguards=on --ion-licm=on --ion-instruction-reordering=off --cache-ir-stubs=on --no-sse41 --monomorphic-inlining=never --ion-load-keys=off --ion-sink=off  <testcase>

Actual results:

Assertion failure: this->flags() == 0, at /root/src/js/src/gc/Cell.h:798

Comment 1

[Jan de Mooij [:jandem]]

I can reproduce this intermittently with rr record -h with --gc-zeal=10 with the reduced test below.

var mod = new WebAssembly.Module(wasmTextToBinary(`(func)`))
var inst = new WebAssembly.Instance(mod);
for (var i = 0; i < 5; i++) {
    newGlobal({"sameZoneAs": this}).Debugger(this).findScripts();
}

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1901407 - Use MaybeForwardedObjectIs in DebuggerScript::trace. r?jonco!

Comment 3

[Jan de Mooij [:jandem]]

The code that's affected/changed is a debug assertion.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f948b0d908e2
Use MaybeForwardedObjectIs in DebuggerScript::trace. r=jonco

Comment 5

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/f948b0d908e2