479551 - Assertion failure: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread, at js/src/jsapi.cpp:957 after typing EOF at js shell prompt

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jeff Walden [:Waldo]]

h-118:~/moz/js-tm jwalden$ obj-i386-apple-darwin8.11.1/dist/bin/js -j
js> var o = {a:3, b:2};
js> shapeOf(o)
149
js> var p = {};
js> p.a =3
3
js> p.b=2
2
js> shapeOf(p)
149
js> Invalid argument
Assertion failure: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread, at /Users/jwalden/moz/js-tm/js/src/jsapi.cpp:957
Trace/BPT trap
h-118:~/moz/js-tm jwalden$ hg log -l1
changeset:   24954:7aee91307a9f
tag:         tip
user:        Jason Orendorff <[e-mail]>
date:        Fri Feb 20 18:22:51 2009 -0600
summary:     Bug 479353 - Crash [@ Detecting] or "Assertion failure: (uint32)(index_) < atoms_->length, at ../jsobj.cpp". r=igor.


("Invalid argument" is actually me hitting Ctrl+D.)

This was using the shell in a browser build of the TM tree, the following revision:

http://hg.mozilla.org/tracemonkey/rev/7aee91307a9f

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

While I was in there I added a tweak to get rid of the "Invalid argument" message.

Comment 2

[Igor Bukanov]

Comment on attachment 363455 [details] [diff] [review]
v1

An alternative is to use JSAutoSuspendRequest from jsapi.h, but that may require to indent the code to limit the scope of the auto class variable.

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v2

JSAutoSuspendRequest doesn't help too much here because we should resume the request before calling JS_ReportError (which can allocate an Error, even in this case I think, depending on cx options).

However, looking at it in that light revealed another exit which I had missed!

We have a bunch of #ifdef JS_THREADSAFE in js.cpp that isn't necessary anymore, so I'm ripping that stuff out too...

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/569dd876fb16

Comment 5

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/45de98fca5ab

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/extensions/regress-479551.js

Jeff, I can't reproduce with this test. Can you take a look and see what I'm doing wrong?

Comment 7

[Jeff Walden [:Waldo]]

The last I recall hearing this needed --enable-readline and (maybe) you had to be on OS X; could you try again with that?

Comment 8

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/1acd85959ecb

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-479551.js,v  <--  regress-479551.js
initial revision: 1.1

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2