Closed Bug 455464 Opened 14 years ago Closed 14 years ago

TM: "Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable)" with gc getter

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9.1b1

People

(Reporter: jruderman, Assigned: brendan)

Details

(Keywords: assertion, testcase, verified1.9.1)

Attachments

(1 file, 1 obsolete file)

$ ~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j 
js> a=b=c=d=0; this.__defineGetter__('g', gc); [1 for each (y in this)];

Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable), at jsinterp.cpp:3289

Some variants trigger this instead:

Assertion failure: ngslots == tm->globalTypeMap->length(), at jstracer.cpp:2452
Oops.  The array comprehension isn't necessary:

js> a=b=c=d=0; this.__defineGetter__('g', gc); for each (y in this);

Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable), at jsinterp.cpp:3289
Summary: "Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable)" with array comprehension and gc getter → "Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable)" with gc getter
Attached patch fix (obsolete) — Splinter Review
IIRC we hacked something like this on your machine, but possibly it was still buggy (returning with gcRunning set? Something like that). This works for me in shell, will test browser when able.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #338829 - Flags: review?(mrbkap)
Attachment #338829 - Attachment is obsolete: true
Attachment #338830 - Flags: review?(mrbkap)
Attachment #338829 - Flags: review?(mrbkap)
Summary: "Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable)" with gc getter → TM: "Assertion failure: !TRACE_RECORDER(cx) ^ (jumpTable == recordingJumpTable)" with gc getter
Comment on attachment 338830 [details] [diff] [review]
fix, without patch for bug 453411 mixed in

Well, we put the initial version above the set slot request stuff, which caused problems (obviously in hindsight).

I wonder if we want to put the out label after the restart stuff to be clear that we will never actually restart if we go to that label.
Attachment #338830 - Flags: review?(mrbkap) → review+
(In reply to comment #4)
> I wonder if we want to put the out label after the restart stuff to be clear
> that we will never actually restart if we go to that label.

Not safe, another thread could come in and try to GC, bumping gcLevel. We need to keep book properly and fully, even if it means another trip 'round the block. We're guaranteed to terminate.

/be
Fixed on tm:

http://hg.mozilla.org/tracemonkey/rev/f59912630f60

/be
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.1b1
Note I couldn't reproduce the original test in the suite although I could by simply running the original test in the shell. -04 was able to reproduce the other assertion ngslots == tm->globalTypeMap->length() by adding a gczeal 2 however.

/cvsroot/mozilla/js/tests/js1_6/extensions/regress-455464-01.js,v  <--  regress-455464-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_6/extensions/regress-455464-02.js,v  <--  regress-455464-02.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_6/extensions/regress-455464-03.js,v  <--  regress-455464-03.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_6/extensions/regress-455464-04.js,v  <--  regress-455464-04.js
initial revision: 1.1
done

http://hg.mozilla.org/mozilla-central/rev/eb923c50f120
Flags: in-testsuite+
Flags: in-litmus-
update test to remove extraneous statements
http://hg.mozilla.org/mozilla-central/rev/e321f7b3c513
v 1.9.1, 1.9.2. -04 times out.
Status: RESOLVED → VERIFIED
Keywords: verified1.9.1
You need to log in before you can comment on or make changes to this bug.