Closed Bug 453955 Opened 16 years ago Closed 15 years ago

"Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c"

Categories

(Core :: JavaScript Engine, defect, P2)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9.2a1

People

(Reporter: gkw, Assigned: brendan)

References

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey [fixed1.9.1b3])

Attachments

(3 files)

for (var z = 0; z < 2; ++z) { [].filter.watch("9", function(y) { yield y; }); }

asserts at

Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c

opt works as expected.

I found this testcase and Jesse Ruderman helped me out as well.
Flags: wanted1.9.0.x?
Does "Version:1.9.0 Branch" mean this _only_ happens on 1.9.0 and does not happen on 1.9.1/trunk? Because otherwise we'd expect this to be nominated for one of the upcoming releases before being fixed on the branch.
(In reply to comment #1)
> Does "Version:1.9.0 Branch" mean this _only_ happens on 1.9.0 and does not
> happen on 1.9.1/trunk? Because otherwise we'd expect this to be nominated for
> one of the upcoming releases before being fixed on the branch.

The previous situation might have been different, but the current status is that it also fails on the trunk, with and without -j. Opt works as expected.


$ ./js-dbg-tm-intelmac 
js> for (var z = 0; z < 2; ++z) { [].filter.watch("9", function(y) { yield y; }); }
Assertion failure: sprop->setter != js_watch_set || pobj != obj, at ../jsdbgapi.cpp:818
Trace/BPT trap

$ ./js-dbg-moz190-intelmac 
js> for (var z = 0; z < 2; ++z) { [].filter.watch("9", function(y) { yield y; }); }
Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c:815
Trace/BPT trap
Flags: wanted1.9.1?
Version: 1.9.0 Branch → Trunk
Ancient bug.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #358344 - Flags: review?(mrbkap)
Safe fix to want for 1.9.1.

/be
OS: Mac OS X → All
Priority: -- → P2
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.1b3
Comment on attachment 358344 [details] [diff] [review]
fix
[Checkin: Comment 7 & 13]

Where'd -p go from your diff options?
Attachment #358344 - Flags: review?(mrbkap) → review+
Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/f1be97f3f736

and m-c:

http://hg.mozilla.org/mozilla-central/rev/cf24acb33102

/be
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey
(In reply to comment #6)
> (From update of attachment 358344 [details] [diff] [review])
> Where'd -p go from your diff options?

You tell me:

... [ui] deleted ...

[extensions]
hgext.mq =
hgext.extdiff =
hgext.parentrevspec =

[defaults]
diff = -U 8 -p

[diff]
git = 1

[extdiff]
# diff -w
cmd.wdiff = diff
opts.wdiff = -wprNU 8

/be
Attached patch patch backportSplinter Review
Here's the 1.9.0.x patch backport. I tested that it fixes the assert.


===

$ diff tm-patch.diff patch-v1.diff 
1,4c1,13
< diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
< --- a/js/src/jsdbgapi.cpp
< +++ b/js/src/jsdbgapi.cpp
< @@ -735,10 +735,13 @@
---
> Index: jsdbgapi.c
> ===================================================================
> RCS file: /cvsroot/mozilla/js/src/jsdbgapi.c,v
> retrieving revision 3.150
> diff -u -8 -p -r3.150 jsdbgapi.c
> --- jsdbgapi.c        4 May 2008 04:20:23 -0000       3.150
> +++ jsdbgapi.c        23 Jan 2009 09:54:32 -0000
> @@ -727,20 +727,23 @@ JS_SetWatchPoint(JSContext *cx, JSObject
>      JSPropertyOp watcher;
>  
>      if (!OBJ_IS_NATIVE(obj)) {
>          JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_WATCH,
>                               OBJ_GET_CLASS(cx, obj)->name);
20a30,34
>      sprop = (JSScopeProperty *) prop;
>      rt = cx->runtime;
>      if (!sprop) {
>          /* Check for a deleted symbol watchpoint, which holds its property. */
>          sprop = js_FindWatchPoint(rt, OBJ_SCOPE(obj), propid);
Attachment #358365 - Flags: review?(brendan)
Attachment #358365 - Flags: approval1.9.0.7?
You wanted:

# Use git diffs for binary diffing, emulate -p
[diff]
git = 1
showfunc = true

Nice catch on the string-index bug, never even occurred to me that might be implicated here.
Flags: wanted1.9.1? → wanted1.9.1+
Attachment #358365 - Flags: review?(brendan) → review+
Attachment #358344 - Flags: approval1.9.1?
Flags: wanted1.9.0.x? → wanted1.9.0.x+
Whiteboard: fixed-in-tracemonkey → fixed-in-tracemonkey [needs 1.9.1 approval and landing]
Attachment #358344 - Flags: approval1.9.1? → approval1.9.1+
Whiteboard: fixed-in-tracemonkey [needs 1.9.1 approval and landing] → fixed-in-tracemonkey [needs 1.9.1 landing]
When is this going to get checked in to 1.9.1? We're waiting for that before taking it on 1.9.0.
Adding checkin-needed to help it find a route into 1.9.1.
Keywords: checkin-needed
Comment on attachment 358344 [details] [diff] [review]
fix
[Checkin: Comment 7 & 13]


http://hg.mozilla.org/releases/mozilla-1.9.1/rev/7acb4539f408
Attachment #358344 - Attachment description: fix → fix [Checkin: Comment 7 & 13]
Whiteboard: fixed-in-tracemonkey [needs 1.9.1 landing] → fixed-in-tracemonkey [fixed1.9.1b3]
Target Milestone: mozilla1.9.1b3 → mozilla1.9.2a1
Comment on attachment 358365 [details] [diff] [review]
patch backport

This didn't land soon enough on 1.9.1 for us to take comfortable on 1.9.0. We'll revisit it for 1.9.0.8.
Attachment #358365 - Flags: approval1.9.0.7? → approval1.9.0.8?
Comment on attachment 358365 [details] [diff] [review]
patch backport

Approved for 1.9.0.8, a=dveditz for release-drivers
Attachment #358365 - Flags: approval1.9.0.8? → approval1.9.0.8+
Brendan, can you land this on 1.9.0 ?
js1_7/extensions/regress-453955.js
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
(In reply to comment #17)
> Brendan, can you land this on 1.9.0 ?

Adding checkin-needed to help get this to 1.9.0 and also it's the only bug to be landed on that branch that's blocking SpiderMonkey 1.8 (see bug 428420).
Keywords: checkin-needed
Blocks: js1.8src
Whiteboard: fixed-in-tracemonkey [fixed1.9.1b3] → [c-n: to 1.9.0/cvs] fixed-in-tracemonkey [fixed1.9.1b3]
mozilla/js/src/jsdbgapi.c 	3.151
Whiteboard: [c-n: to 1.9.0/cvs] fixed-in-tracemonkey [fixed1.9.1b3] → fixed-in-tracemonkey [fixed1.9.1b3]
You need to log in before you can comment on or make changes to this bug.