Assertion failure: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread, at js/src/jsapi.cpp:957 after typing EOF at js shell prompt

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: Waldo, Assigned: jorendorff)

Tracking

({testcase, verified1.9.1})

Trunk
testcase, verified1.9.1
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments, 1 obsolete attachment)

h-118:~/moz/js-tm jwalden$ obj-i386-apple-darwin8.11.1/dist/bin/js -j
js> var o = {a:3, b:2};
js> shapeOf(o)
149
js> var p = {};
js> p.a =3
3
js> p.b=2
2
js> shapeOf(p)
149
js> Invalid argument
Assertion failure: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread, at /Users/jwalden/moz/js-tm/js/src/jsapi.cpp:957
Trace/BPT trap
h-118:~/moz/js-tm jwalden$ hg log -l1
changeset:   24954:7aee91307a9f
tag:         tip
user:        Jason Orendorff <jorendorff@mozilla.com>
date:        Fri Feb 20 18:22:51 2009 -0600
summary:     Bug 479353 - Crash [@ Detecting] or "Assertion failure: (uint32)(index_) < atoms_->length, at ../jsobj.cpp". r=igor.


("Invalid argument" is actually me hitting Ctrl+D.)

This was using the shell in a browser build of the TM tree, the following revision:

http://hg.mozilla.org/tracemonkey/rev/7aee91307a9f
(Assignee)

Comment 1

9 years ago
Created attachment 363455 [details] [diff] [review]
v1

While I was in there I added a tweak to get rid of the "Invalid argument" message.
Assignee: general → jorendorff
Status: NEW → ASSIGNED
Attachment #363455 - Flags: review?(igor)
(Assignee)

Updated

9 years ago
Summary: Assertion failure: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread, at js/src/jsapi.cpp:957 doing almost nothing → Assertion failure: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread, at js/src/jsapi.cpp:957 after typing EOF at js shell prompt

Comment 2

9 years ago
Comment on attachment 363455 [details] [diff] [review]
v1

An alternative is to use JSAutoSuspendRequest from jsapi.h, but that may require to indent the code to limit the scope of the auto class variable.
Attachment #363455 - Flags: review?(igor) → review+
(Assignee)

Comment 3

9 years ago
Created attachment 363740 [details] [diff] [review]
v2

JSAutoSuspendRequest doesn't help too much here because we should resume the request before calling JS_ReportError (which can allocate an Error, even in this case I think, depending on cx options).

However, looking at it in that light revealed another exit which I had missed!

We have a bunch of #ifdef JS_THREADSAFE in js.cpp that isn't necessary anymore, so I'm ripping that stuff out too...
Attachment #363455 - Attachment is obsolete: true
Attachment #363740 - Flags: review?(mrbkap)

Updated

9 years ago
Attachment #363740 - Flags: review?(mrbkap) → review+

Comment 4

9 years ago
http://hg.mozilla.org/mozilla-central/rev/569dd876fb16
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 5

9 years ago
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/45de98fca5ab
Keywords: fixed1.9.1

Updated

9 years ago
Keywords: testcase

Comment 6

9 years ago
Created attachment 368104 [details]
js1_5/extensions/regress-479551.js

Jeff, I can't reproduce with this test. Can you take a look and see what I'm doing wrong?
The last I recall hearing this needed --enable-readline and (maybe) you had to be on OS X; could you try again with that?

Comment 8

9 years ago
http://hg.mozilla.org/tracemonkey/rev/1acd85959ecb

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-479551.js,v  <--  regress-479551.js
initial revision: 1.1
Flags: in-testsuite+

Comment 9

9 years ago
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.