Closed
Bug 488607
Opened 15 years ago
Closed 15 years ago
mochitests crash FF trunk build in Toolkit section of mochitest :: Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN
Categories
(Core :: JavaScript Engine, defect, P2)
Tracking
()
RESOLVED
FIXED
People
(Reporter: murali, Assigned: igor)
References
Details
(Keywords: fixed1.9.1, regression, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
3.47 KB,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
ARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x80004001: file /home/mnandigama/src/content/events/src/nsIMEStateManager.cpp, line 559 WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x80004001: file /home/mnandigama/src/content/events/src/nsIMEStateManager.cpp, line 559 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'. See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113 ++DOMWINDOW == 11 (0xa7644730) [serial = 12] [outer = 0xb66ae080] ++WEBSHELL 0xaa2e88d0 == 7 ++DOMWINDOW == 12 (0xa7644e30) [serial = 13] [outer = (nil)] ++DOMWINDOW == 13 (0xa76466b0) [serial = 14] [outer = 0xa7644e00] --WEBSHELL 0xaa2e8110 == 6 ++DOMWINDOW == 14 (0xa7644570) [serial = 15] [outer = 0xa7644e00] Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN, at /home/mnandigama/src/js/src/jsopcode.cpp:147 TEST-UNEXPECTED-FAIL | (automation.py) | Exited with code -5 during test run INFO | (automation.py) | Application ran for: 0:02:15.705941 WARNING: nsExceptionService ignoring thread destruction after shutdown: file /home/mnandigama/src/xpcom/base/nsExceptionService.cpp, line 194 nsStringStats => mAllocCount: 37966 => mReallocCount: 238 => mFreeCount: 37966 => mShareCount: 11775 => mAdoptCount: 298 => mAdoptFreeCount: 298 TEST-UNEXPECTED-FAIL | runtests-leaks | missing output line for total leaks!
Comment 1•15 years ago
|
||
Those storage warnings certainly are not the cause of the JS assertion, which is likely the bug you are trying to file, right?
Reporter | ||
Comment 2•15 years ago
|
||
I don't know. If you feel like adding any JS folks to the
Comment 3•15 years ago
|
||
I'm certain enough to move it and let them all pick it up...
Assignee: nobody → general
Component: Storage → JavaScript Engine
Product: Toolkit → Core
QA Contact: storage → general
Summary: mochitests crash FF trunk build in Toolkit section of mochitest :: Failure in Storage -> JS → mochitests crash FF trunk build in Toolkit section of mochitest :: Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN
Comment 4•15 years ago
|
||
any hint in the log as to which test caused the assertion?
Reporter | ||
Comment 5•15 years ago
|
||
The browser crashes as soon as you start the http://localhost:8888/tests/toolkit?autorun=1 in the browser window spawned by the command 'python runtests.py'
Comment 6•15 years ago
|
||
works for me with a fresh 1.9.2 debug build. Is this one of your code coverage customized builds? Can you reproduce with a clean build ?
Reporter | ||
Comment 7•15 years ago
|
||
Yes it is a profiled build. Not a simple debug build. I will try your suggestion.
I hit this bug running mochitests in my Linux debug build. My build has quite a few patches in it but nothing that should be affecting JS or DOM. My build has no code coverage or other instrumentation in it. The last test line is 74426 INFO TEST-PASS | /tests/toolkit/components/microformats/tests/test_Microformats.html | date round trip I guess the next test would be test_Microformats_add.html. I can actually reproduce the crash. Let me try with gdb...
Flags: blocking1.9.1?
I have to open the toolkit/components/microformats/tests directory, then click on "Run Tests", then I crash. (gdb) where #0 JS_Assert (s=0xb7eb1270 "js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN", file=0xb7eb0fbc "/home/roc/shared/mozilla-compositor/js/src/jsopcode.cpp", ln=147) at /home/roc/shared/mozilla-compositor/js/src/jsutil.cpp:69 #1 0xb7dbc9d1 in js_GetIndexFromBytecode (cx=0xab6a6c00, script=0xabb82800, pc=0xabb82910 "�\024\b��V", pcoff=0) at /home/roc/shared/mozilla-compositor/js/src/jsopcode.cpp:147 #2 0xb7e40521 in TraceRecorder::test_property_cache (this=0xabc0bde0, obj=0xab88cc80, obj_ins=0xb251d894, obj2=@0xbfd7f944, pcval=@0xbfd7f940) at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:5988 #3 0xb7e408e9 in TraceRecorder::prop (this=0xabc0bde0, obj=0xab88cc80, obj_ins=0xb251d894, slot=@0xbfd7f9a0, v_ins=@0xbfd7f99c) at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:8157 #4 0xb7e4a2b1 in TraceRecorder::getProp (this=0xabc0bde0, obj=0xab88cc80, obj_ins=0xb251d894) at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:8329 #5 0xb7e4a8b4 in TraceRecorder::record_JSOP_LENGTH (this=0xabc0bde0) at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:9909 #6 0xb7e53d16 in TraceRecorder::monitorRecording (cx=0xab6a6c00, tr=0xabc0bde0, op=JSOP_LENGTH) at /home/roc/shared/mozilla-compositor/js/src/jsopcode.tbl:550 #7 0xb7d6ec55 in js_Interpret (cx=0xab6a6c00) at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:3043 #8 0xb7d9a9f1 in js_Invoke (cx=0xab6a6c00, argc=1, vp=0xab2622dc, flags=0) at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:1388 #9 0xb7d65841 in js_fun_apply (cx=0xab6a6c00, argc=1, vp=0xab2622a4) at /home/roc/shared/mozilla-compositor/js/src/jsfun.cpp:1778 #10 0xb7d868f2 in js_Interpret (cx=0xab6a6c00) at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:5128 #11 0xb7d99c08 in js_Execute (cx=0xab6a6c00, chain=0xadc6ed80, script=0xafedeb00, down=0x0, flags=0, result=0x0) at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:1614 #12 0xb7d128ce in JS_EvaluateUCScriptForPrincipals (cx=0xab6a6c00, obj=0xadc6ed80, principals=0xab471064, chars=0xaacfc008, length=5709, filename=0xabb26888 "http://localhost:8888/tests/toolkit/components/microformats/tests/test_Microformats.html", lineno=192, rval=0x0) at /home/roc/shared/mozilla-compositor/js/src/jsapi.cpp:5183 #13 0xb4dd596c in nsJSContext::EvaluateString (this=0xaba89f10, aScript=@0xbfd80bdc, aScopeObject=0xadc6ed80, aPrincipal=0xab471060, aURL=0xabb26888 "http://localhost:8888/tests/toolkit/components/microformats/tests/test_Microformats.html", aLineNo=192, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfd80b74) at /home/roc/shared/mozilla-compositor/dom/base/nsJSEnvironment.cpp:1603 #14 0xb4b898e5 in nsScriptLoader::EvaluateScript (this=0xab6579a0, aRequest=0xb6db2370, aScript=@0xbfd80bdc) at /home/roc/shared/mozilla-compositor/content/base/src/nsScriptLoader.cpp:686 #15 0xb4b89b51 in nsScriptLoader::ProcessRequest (this=0xab6579a0, aRequest=0xb6db2370) at /home/roc/shared/mozilla-compositor/content/base/src/nsScriptLoader.cpp:600 #16 0xb4b89bea in nsScriptLoader::ProcessPendingRequests (this=0xab6579a0) at /home/roc/shared/mozilla-compositor/content/base/src/nsScriptLoader.cpp:739 #17 0xb4b8cbe8 in nsRunnableMethod<nsScriptLoader, void>::Run (this=0xad943820) at ../../../dist/include/xpcom/nsThreadUtils.h:264 #18 0xb7c9280b in nsThread::ProcessNextEvent (this=0xb6c859c0, mayWait=1, result=0xbfd80d74) at /home/roc/shared/mozilla-compositor/xpcom/threads/nsThread.cpp:510 p ::DumpJSStack() did something that caused gdb to exit without dumping the stack.
In frame #1 (different run, but stack is the same): (gdb) p op $1 = JSOP_LENGTH (gdb) p js_CodeSpec[op] $2 = {length = 1 '\001', nuses = 1 '\001', ndefs = 1 '\001', prec = 18 '\022', format = 64} (gdb) p pcoff $3 = 0
Comment 11•15 years ago
|
||
(In reply to comment #6) > works for me with a fresh 1.9.2 debug build. Is this one of your code coverage > customized builds? Can you reproduce with a clean build ? I hit this every time with a 1.9.2 debug build on OS X (and I just clobbered): > python _tests/testing/mochitest/runtests.py --console-level=INFO --autorun --test-path=toolkit ... *** 26 INFO TEST-PASS | /tests/toolkit/components/microformats/tests/test_Microformats.html | date round trip Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN, at /Users/peterv/source/mozilla/central/mozilla/js/src/jsopcode.cpp:147 TEST-UNEXPECTED-FAIL | (automation.py) | Exited with code 6 during test run ... Can't run full mochitest on a debug build right now.
Comment 12•15 years ago
|
||
It's a bogus assertion. Igor, this looks like unexpected fallout from a recent fix you landed. I remember a special case for JSOP_LENGTH -- did it get removed? /be
Assignee | ||
Updated•15 years ago
|
Assignee: general → igor
Comment 13•15 years ago
|
||
I don't think this blocks release, but obviously important for developers.
Flags: blocking1.9.1? → blocking1.9.1-
Do we have any proof that this assertion only affects debug builds? As far as I know, we don't, and if we don't, it probably affects opt builds too on some testcase, and it's a crash regression, so I argue it should block.
Flags: blocking1.9.1- → blocking1.9.1?
Oh I guess Brendan is saying that the assertion is just wrong and so it would only affect debug builds.
Flags: blocking1.9.1? → blocking1.9.1-
Comment 16•15 years ago
|
||
Igor should render a verdict. In the mean time, treat assertions as criticals. /be
Flags: blocking1.9.1- → blocking1.9.1?
Comment 17•15 years ago
|
||
(I'll let Igor adjust the severity or importance or whatever it's called.)
Updated•15 years ago
|
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
Assignee | ||
Comment 18•15 years ago
|
||
(In reply to comment #12) > It's a bogus assertion. Igor, this looks like unexpected fallout from a recent > fix you landed. I remember a special case for JSOP_LENGTH -- did it get > removed? test_prop_cache has never contained any special check for JSOP_LENGTH since the debug-only code appeared in bug 452693.
Blocks: 452693
Keywords: regression
Assignee | ||
Comment 19•15 years ago
|
||
The patch adds the missing JSOP_LENGTH check so test_property_cache uses the same pattern as js_FillPropertyCache and js_FullTestPropertyCache do.
Attachment #375290 -
Flags: review?(brendan)
Comment 20•15 years ago
|
||
Comment on attachment 375290 [details] [diff] [review] v1 I know I wrote this code once already (I used the atom local instead of declaring pcatom) but I do not know what became of that code. Oh well, better late than never! /be
Attachment #375290 -
Flags: review?(brendan) → review+
Assignee | ||
Comment 21•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/bf31ea893f39
Whiteboard: fixed-in-tracemonkey
Comment 22•15 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/bf31ea893f39
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Comment 23•15 years ago
|
||
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/51e40b456cec
Keywords: fixed1.9.1
You need to log in
before you can comment on or make changes to this bug.
Description
•