"Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c"

VERIFIED FIXED in mozilla1.9.2a1

Status

()

P2
critical
VERIFIED FIXED
10 years ago
10 years ago

People

(Reporter: gkw, Assigned: brendan)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.9.2a1
assertion, testcase, verified1.9.0.9, verified1.9.1
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.9.1 +
wanted1.9.0.x +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey [fixed1.9.1b3])

Attachments

(3 attachments)

(Reporter)

Description

10 years ago
Created attachment 337195 [details]
gdb backtraces (normal and full)

for (var z = 0; z < 2; ++z) { [].filter.watch("9", function(y) { yield y; }); }

asserts at

Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c

opt works as expected.

I found this testcase and Jesse Ruderman helped me out as well.
Flags: wanted1.9.0.x?
Does "Version:1.9.0 Branch" mean this _only_ happens on 1.9.0 and does not happen on 1.9.1/trunk? Because otherwise we'd expect this to be nominated for one of the upcoming releases before being fixed on the branch.
(Reporter)

Comment 2

10 years ago
(In reply to comment #1)
> Does "Version:1.9.0 Branch" mean this _only_ happens on 1.9.0 and does not
> happen on 1.9.1/trunk? Because otherwise we'd expect this to be nominated for
> one of the upcoming releases before being fixed on the branch.

The previous situation might have been different, but the current status is that it also fails on the trunk, with and without -j. Opt works as expected.


$ ./js-dbg-tm-intelmac 
js> for (var z = 0; z < 2; ++z) { [].filter.watch("9", function(y) { yield y; }); }
Assertion failure: sprop->setter != js_watch_set || pobj != obj, at ../jsdbgapi.cpp:818
Trace/BPT trap

$ ./js-dbg-moz190-intelmac 
js> for (var z = 0; z < 2; ++z) { [].filter.watch("9", function(y) { yield y; }); }
Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c:815
Trace/BPT trap
Flags: wanted1.9.1?
Version: 1.9.0 Branch → Trunk

Updated

10 years ago
Duplicate of this bug: 474901
(Assignee)

Comment 4

10 years ago
Created attachment 358344 [details] [diff] [review]
fix
[Checkin: Comment 7 & 13]

Ancient bug.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #358344 - Flags: review?(mrbkap)
(Assignee)

Comment 5

10 years ago
Safe fix to want for 1.9.1.

/be
OS: Mac OS X → All
Priority: -- → P2
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.1b3
Comment on attachment 358344 [details] [diff] [review]
fix
[Checkin: Comment 7 & 13]

Where'd -p go from your diff options?
Attachment #358344 - Flags: review?(mrbkap) → review+
(Assignee)

Comment 7

10 years ago
Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/f1be97f3f736

and m-c:

http://hg.mozilla.org/mozilla-central/rev/cf24acb33102

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey
(Assignee)

Comment 8

10 years ago
(In reply to comment #6)
> (From update of attachment 358344 [details] [diff] [review])
> Where'd -p go from your diff options?

You tell me:

... [ui] deleted ...

[extensions]
hgext.mq =
hgext.extdiff =
hgext.parentrevspec =

[defaults]
diff = -U 8 -p

[diff]
git = 1

[extdiff]
# diff -w
cmd.wdiff = diff
opts.wdiff = -wprNU 8

/be
(Reporter)

Comment 9

10 years ago
Created attachment 358365 [details] [diff] [review]
patch backport

Here's the 1.9.0.x patch backport. I tested that it fixes the assert.


===

$ diff tm-patch.diff patch-v1.diff 
1,4c1,13
< diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
< --- a/js/src/jsdbgapi.cpp
< +++ b/js/src/jsdbgapi.cpp
< @@ -735,10 +735,13 @@
---
> Index: jsdbgapi.c
> ===================================================================
> RCS file: /cvsroot/mozilla/js/src/jsdbgapi.c,v
> retrieving revision 3.150
> diff -u -8 -p -r3.150 jsdbgapi.c
> --- jsdbgapi.c        4 May 2008 04:20:23 -0000       3.150
> +++ jsdbgapi.c        23 Jan 2009 09:54:32 -0000
> @@ -727,20 +727,23 @@ JS_SetWatchPoint(JSContext *cx, JSObject
>      JSPropertyOp watcher;
>  
>      if (!OBJ_IS_NATIVE(obj)) {
>          JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_WATCH,
>                               OBJ_GET_CLASS(cx, obj)->name);
20a30,34
>      sprop = (JSScopeProperty *) prop;
>      rt = cx->runtime;
>      if (!sprop) {
>          /* Check for a deleted symbol watchpoint, which holds its property. */
>          sprop = js_FindWatchPoint(rt, OBJ_SCOPE(obj), propid);
Attachment #358365 - Flags: review?(brendan)
Attachment #358365 - Flags: approval1.9.0.7?

Comment 10

10 years ago
You wanted:

# Use git diffs for binary diffing, emulate -p
[diff]
git = 1
showfunc = true

Nice catch on the string-index bug, never even occurred to me that might be implicated here.

Updated

10 years ago
Flags: wanted1.9.1? → wanted1.9.1+
(Assignee)

Updated

10 years ago
Attachment #358365 - Flags: review?(brendan) → review+
(Assignee)

Updated

10 years ago
Attachment #358344 - Flags: approval1.9.1?
Flags: wanted1.9.0.x? → wanted1.9.0.x+
Whiteboard: fixed-in-tracemonkey → fixed-in-tracemonkey [needs 1.9.1 approval and landing]

Updated

10 years ago
Attachment #358344 - Flags: approval1.9.1? → approval1.9.1+
(Reporter)

Updated

10 years ago
Whiteboard: fixed-in-tracemonkey [needs 1.9.1 approval and landing] → fixed-in-tracemonkey [needs 1.9.1 landing]
When is this going to get checked in to 1.9.1? We're waiting for that before taking it on 1.9.0.
Adding checkin-needed to help it find a route into 1.9.1.
Keywords: checkin-needed
Comment on attachment 358344 [details] [diff] [review]
fix
[Checkin: Comment 7 & 13]


http://hg.mozilla.org/releases/mozilla-1.9.1/rev/7acb4539f408
Attachment #358344 - Attachment description: fix → fix [Checkin: Comment 7 & 13]
Keywords: checkin-needed → fixed1.9.1
Whiteboard: fixed-in-tracemonkey [needs 1.9.1 landing] → fixed-in-tracemonkey [fixed1.9.1b3]
Target Milestone: mozilla1.9.1b3 → mozilla1.9.2a1
Comment on attachment 358365 [details] [diff] [review]
patch backport

This didn't land soon enough on 1.9.1 for us to take comfortable on 1.9.0. We'll revisit it for 1.9.0.8.
Attachment #358365 - Flags: approval1.9.0.7? → approval1.9.0.8?
Comment on attachment 358365 [details] [diff] [review]
patch backport

Approved for 1.9.0.8, a=dveditz for release-drivers
Attachment #358365 - Flags: approval1.9.0.8? → approval1.9.0.8+

Comment 16

10 years ago
http://hg.mozilla.org/mozilla-central/rev/ef0dfc2d4347
Flags: in-testsuite+
Flags: in-litmus-

Comment 17

10 years ago
Brendan, can you land this on 1.9.0 ?

Comment 18

10 years ago
js1_7/extensions/regress-453955.js
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
(Reporter)

Comment 19

10 years ago
(In reply to comment #17)
> Brendan, can you land this on 1.9.0 ?

Adding checkin-needed to help get this to 1.9.0 and also it's the only bug to be landed on that branch that's blocking SpiderMonkey 1.8 (see bug 428420).
Keywords: checkin-needed
Blocks: 428420
Whiteboard: fixed-in-tracemonkey [fixed1.9.1b3] → [c-n: to 1.9.0/cvs] fixed-in-tracemonkey [fixed1.9.1b3]
mozilla/js/src/jsdbgapi.c 	3.151
Keywords: checkin-needed → fixed1.9.0.8
Whiteboard: [c-n: to 1.9.0/cvs] fixed-in-tracemonkey [fixed1.9.1b3] → fixed-in-tracemonkey [fixed1.9.1b3]

Comment 21

10 years ago
v 1.9.0
Keywords: fixed1.9.0.8 → verified1.9.0.8
You need to log in before you can comment on or make changes to this bug.