1975376 - Assertion failure running JIT test debug/private-methods-eval-in-frame.js with GC zeal mode 10

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jon Coppeard (:jonco)]

I don't know why this passes on CI but this fails for me locally on Linux:

[1728091] Assertion failure: ptr.found() && &*ptr == &r.front(), at /home/jon/clone/firefox/js/src/gc/Marking-inl.h:202

Backtrace from gdb:

(gdb) bt
#0  0x00005555573e8f02 in MOZ_CrashSequence (aAddress=0x0, aLine=202) at /home/jon/clone/firefox/optdebug-shell-build/dist/include/mozilla/Assertions.h:248
#1  js::gc::CheckTableEntryAfterMovingGC<mozilla::HashMap<js::MissingEnvironmentKey, js::WeakHeapPtr<js::DebugEnvironmentProxy*>, js::MissingEnvironmentKey, js::TrackedAllocPolicy<(js::TrackingKind)1> >, mozilla::detail::HashTable<mozilla::HashMapEntry<js::MissingEnvironmentKey, js::WeakHeapPtr<js::DebugEnvironmentProxy*> >, mozilla::HashMap<js::MissingEnvironmentKey, js::WeakHeapPtr<js::DebugEnvironmentProxy*>, js::MissingEnvironmentKey, js::TrackedAllocPolicy<(js::TrackingKind)1> >::MapHashPolicy, js::TrackedAllocPolicy<(js::TrackingKind)1> >::Range, js::MissingEnvironmentKey> (table=..., r=..., lookup=...)
    at /home/jon/clone/firefox/js/src/gc/Marking-inl.h:202
#2  0x00005555573bd013 in js::gc::CheckTableAfterMovingGC<mozilla::HashMap<js::MissingEnvironmentKey, js::WeakHeapPtr<js::DebugEnvironmentProxy*>, js::MissingEnvironmentKey, js::TrackedAllocPolicy<(js::TrackingKind)1> >, js::DebugEnvironments::checkHashTablesAfterMovingGC()::$_0>(mozilla::HashMap<js::MissingEnvironmentKey, js::WeakHeapPtr<js::DebugEnvironmentProxy*>, js::MissingEnvironmentKey, js::TrackedAllocPolicy<(js::TrackingKind)1> > const&, js::DebugEnvironments::checkHashTablesAfterMovingGC()::$_0&&) (table=..., checkEntryAndGetLookup=<optimised out>) at /home/jon/clone/firefox/js/src/gc/Marking-inl.h:209
#3  js::DebugEnvironments::checkHashTablesAfterMovingGC (this=0x7ffff62adbb0) at /home/jon/clone/firefox/js/src/vm/EnvironmentObject.cpp:2750
#4  0x0000555557c98f4b in js::gc::GCRuntime::checkHashTablesAfterMovingGC (this=0x7ffff62308a0) at /home/jon/clone/firefox/js/src/gc/GC.cpp:5383
#5  0x0000555557c4894a in js::gc::GCRuntime::compactPhase (this=0x7ffff62308a0, reason=JS::GCReason::ABORT_GC, sliceBudget=<optimised out>, session=...)
    at /home/jon/clone/firefox/js/src/gc/Compacting.cpp:126
#6  0x0000555557c90b0d in js::gc::GCRuntime::incrementalSlice
    (this=this@entry=0x7ffff62308a0, budget=..., reason=reason@entry=JS::GCReason::ABORT_GC, budgetWasIncreased=<optimised out>)
    at /home/jon/clone/firefox/js/src/gc/GC.cpp:4130
#7  0x0000555557c93cb3 in js::gc::GCRuntime::gcCycle
    (this=this@entry=0x7ffff62308a0, nonincrementalByAPI=false, budgetArg=..., reason=reason@entry=JS::GCReason::ABORT_GC)
    at /home/jon/clone/firefox/js/src/gc/GC.cpp:4604
#8  0x0000555557c9550d in js::gc::GCRuntime::collect
    (this=this@entry=0x7ffff62308a0, nonincrementalByAPI=<optimised out>, budget=..., reason=reason@entry=JS::GCReason::ABORT_GC)
    at /home/jon/clone/firefox/js/src/gc/GC.cpp:4786
#9  0x0000555557c96226 in js::gc::GCRuntime::abortGC (this=0x7ffff62308a0) at /home/jon/clone/firefox/js/src/gc/GC.cpp:4915
#10 0x0000555557c73141 in js::gc::GCRuntime::finishGC (this=0x7ffff7a05700 <_IO_stdfile_2_lock>, reason=<optimised out>)
    at /home/jon/clone/firefox/js/src/gc/GC.cpp:4900
#11 0x0000555557c77a6d in JS::FinishIncrementalGC (cx=<optimised out>, reason=JS::GCReason::API) at /home/jon/clone/firefox/js/src/gc/GCAPI.cpp:334
#12 0x00005555575f0959 in JSRuntime::destroyRuntime (this=0x7ffff6230000) at /home/jon/clone/firefox/js/src/vm/Runtime.cpp:224
#13 0x000055555745df80 in js::DestroyContext (cx=cx@entry=0x7ffff623a200) at /home/jon/clone/firefox/js/src/vm/JSContext.cpp:227
#14 0x00005555578c734a in JS_DestroyContext (cx=0x7ffff7a05700 <_IO_stdfile_2_lock>, cx@entry=0x7ffff623a200) at /home/jon/clone/firefox/js/src/jsapi.cpp:410
#15 0x000055555714f8cd in main::$_1::operator() (this=<optimised out>) at /home/jon/clone/firefox/js/src/shell/js.cpp:12393
#16 mozilla::ScopeExit<main::$_1>::~ScopeExit (this=<optimised out>) at /home/jon/clone/firefox/optdebug-shell-build/dist/include/mozilla/ScopeExit.h:106
#17 main (argc=<optimised out>, argv=0x7fffffffe5f8) at /home/jon/clone/firefox/js/src/shell/js.cpp:12486

It also fails on macOS but only 50% of the time.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

changeset:   794819:c42e89b08392
user:        Tooru Fujisawa <[e-mail]>
date:        Wed Jul 02 11:03:28 2025 +0000
summary:     Bug 1970388 - Part 2: Reflect the enclosing environment to MissingEnvironmentMap. r=bthrall

changeset:   794818:d4c97004a4a1
user:        Tooru Fujisawa <[e-mail]>
date:        Wed Jul 02 11:03:28 2025 +0000
summary:     Bug 1970388 - Part 1: Add more info to EnvironmentObject::dump. r=bthrall

Vague wave in the dark: first frame mentions "environment" and recent commits involving "environment" point to bug 1970388, so setting needinfo from :arai-san as a start.

Please feel free to pass this forward if incorrect.

Comment 2

[Jon Coppeard (:jonco)]

Fixed by backout of bug 1970388.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1970388

Comment 5

[Intermittent Failures Robot]

13 failures were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 7
• mozilla-central: 6

Table

	no_variant
linux64/debug-x86/debug	13

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1975376&startday=2025-06-30&endday=2025-07-06&tree=all