Closed Bug 488607 Opened 11 years ago Closed 11 years ago

mochitests crash FF trunk build in Toolkit section of mochitest :: Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN

Categories

(Core :: JavaScript Engine, defect, P2)

x86
Linux
defect

Tracking

()

RESOLVED FIXED

People

(Reporter: murali, Assigned: igor)

References

Details

(Keywords: fixed1.9.1, regression, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

ARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x80004001: file /home/mnandigama/src/content/events/src/nsIMEStateManager.cpp, line 559
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x80004001: file /home/mnandigama/src/content/events/src/nsIMEStateManager.cpp, line 559
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35ca68'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
WARNING: 1 sort operation has occurred for the SQL statement '0xaf35c978'.  See https://developer.mozilla.org/En/Storage/Warnings details.: file /home/mnandigama/src/storage/src/mozStoragePrivateHelpers.cpp, line 113
++DOMWINDOW == 11 (0xa7644730) [serial = 12] [outer = 0xb66ae080]
++WEBSHELL 0xaa2e88d0 == 7
++DOMWINDOW == 12 (0xa7644e30) [serial = 13] [outer = (nil)]
++DOMWINDOW == 13 (0xa76466b0) [serial = 14] [outer = 0xa7644e00]
--WEBSHELL 0xaa2e8110 == 6
++DOMWINDOW == 14 (0xa7644570) [serial = 15] [outer = 0xa7644e00]
Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN, at /home/mnandigama/src/js/src/jsopcode.cpp:147
TEST-UNEXPECTED-FAIL | (automation.py) | Exited with code -5 during test run
INFO | (automation.py) | Application ran for: 0:02:15.705941
WARNING: nsExceptionService ignoring thread destruction after shutdown: file /home/mnandigama/src/xpcom/base/nsExceptionService.cpp, line 194
nsStringStats
 => mAllocCount:          37966
 => mReallocCount:          238
 => mFreeCount:           37966
 => mShareCount:          11775
 => mAdoptCount:            298
 => mAdoptFreeCount:        298
TEST-UNEXPECTED-FAIL | runtests-leaks | missing output line for total leaks!
Those storage warnings certainly are not the cause of the JS assertion, which is likely the bug you are trying to file, right?
I don't know. If you feel like adding any JS folks to the
I'm certain enough to move it and let them all pick it up...
Assignee: nobody → general
Component: Storage → JavaScript Engine
Product: Toolkit → Core
QA Contact: storage → general
Summary: mochitests crash FF trunk build in Toolkit section of mochitest :: Failure in Storage -> JS → mochitests crash FF trunk build in Toolkit section of mochitest :: Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN
any hint in the log as to which test caused the assertion?
The browser crashes as soon as you start the http://localhost:8888/tests/toolkit?autorun=1 in the browser window spawned by the command 'python runtests.py'
works for me with a fresh 1.9.2 debug build. Is this one of your code coverage customized builds? Can you reproduce with a clean build ?
Yes it is a profiled build. Not a simple debug build. I will try your suggestion.
I hit this bug running mochitests in my Linux debug build. My build has quite a few patches in it but nothing that should be affecting JS or DOM. My build has no code coverage or other instrumentation in it.

The last test line is
74426 INFO TEST-PASS | /tests/toolkit/components/microformats/tests/test_Microformats.html | date round trip

I guess the next test would be test_Microformats_add.html.

I can actually reproduce the crash. Let me try with gdb...
Flags: blocking1.9.1?
I have to open the toolkit/components/microformats/tests directory, then click on "Run Tests", then I crash.

(gdb) where
#0  JS_Assert (s=0xb7eb1270 "js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN", 
    file=0xb7eb0fbc "/home/roc/shared/mozilla-compositor/js/src/jsopcode.cpp", 
    ln=147) at /home/roc/shared/mozilla-compositor/js/src/jsutil.cpp:69
#1  0xb7dbc9d1 in js_GetIndexFromBytecode (cx=0xab6a6c00, script=0xabb82800, 
    pc=0xabb82910 "�\024\b��V", pcoff=0)
    at /home/roc/shared/mozilla-compositor/js/src/jsopcode.cpp:147
#2  0xb7e40521 in TraceRecorder::test_property_cache (this=0xabc0bde0, 
    obj=0xab88cc80, obj_ins=0xb251d894, obj2=@0xbfd7f944, pcval=@0xbfd7f940)
    at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:5988
#3  0xb7e408e9 in TraceRecorder::prop (this=0xabc0bde0, obj=0xab88cc80, 
    obj_ins=0xb251d894, slot=@0xbfd7f9a0, v_ins=@0xbfd7f99c)
    at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:8157
#4  0xb7e4a2b1 in TraceRecorder::getProp (this=0xabc0bde0, obj=0xab88cc80, 
    obj_ins=0xb251d894)
    at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:8329
#5  0xb7e4a8b4 in TraceRecorder::record_JSOP_LENGTH (this=0xabc0bde0)
    at /home/roc/shared/mozilla-compositor/js/src/jstracer.cpp:9909
#6  0xb7e53d16 in TraceRecorder::monitorRecording (cx=0xab6a6c00, tr=0xabc0bde0, 
    op=JSOP_LENGTH) at /home/roc/shared/mozilla-compositor/js/src/jsopcode.tbl:550
#7  0xb7d6ec55 in js_Interpret (cx=0xab6a6c00)
    at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:3043
#8  0xb7d9a9f1 in js_Invoke (cx=0xab6a6c00, argc=1, vp=0xab2622dc, flags=0)
    at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:1388
#9  0xb7d65841 in js_fun_apply (cx=0xab6a6c00, argc=1, vp=0xab2622a4)
    at /home/roc/shared/mozilla-compositor/js/src/jsfun.cpp:1778
#10 0xb7d868f2 in js_Interpret (cx=0xab6a6c00)
    at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:5128
#11 0xb7d99c08 in js_Execute (cx=0xab6a6c00, chain=0xadc6ed80, script=0xafedeb00, 
    down=0x0, flags=0, result=0x0)
    at /home/roc/shared/mozilla-compositor/js/src/jsinterp.cpp:1614
#12 0xb7d128ce in JS_EvaluateUCScriptForPrincipals (cx=0xab6a6c00, obj=0xadc6ed80, 
    principals=0xab471064, chars=0xaacfc008, length=5709, 
    filename=0xabb26888 "http://localhost:8888/tests/toolkit/components/microformats/tests/test_Microformats.html", lineno=192, rval=0x0)
    at /home/roc/shared/mozilla-compositor/js/src/jsapi.cpp:5183
#13 0xb4dd596c in nsJSContext::EvaluateString (this=0xaba89f10, aScript=@0xbfd80bdc, 
    aScopeObject=0xadc6ed80, aPrincipal=0xab471060, 
    aURL=0xabb26888 "http://localhost:8888/tests/toolkit/components/microformats/tests/test_Microformats.html", aLineNo=192, aVersion=0, aRetValue=0x0, 
    aIsUndefined=0xbfd80b74)
    at /home/roc/shared/mozilla-compositor/dom/base/nsJSEnvironment.cpp:1603
#14 0xb4b898e5 in nsScriptLoader::EvaluateScript (this=0xab6579a0, 
    aRequest=0xb6db2370, aScript=@0xbfd80bdc)
    at /home/roc/shared/mozilla-compositor/content/base/src/nsScriptLoader.cpp:686
#15 0xb4b89b51 in nsScriptLoader::ProcessRequest (this=0xab6579a0, 
    aRequest=0xb6db2370)
    at /home/roc/shared/mozilla-compositor/content/base/src/nsScriptLoader.cpp:600
#16 0xb4b89bea in nsScriptLoader::ProcessPendingRequests (this=0xab6579a0)
    at /home/roc/shared/mozilla-compositor/content/base/src/nsScriptLoader.cpp:739
#17 0xb4b8cbe8 in nsRunnableMethod<nsScriptLoader, void>::Run (this=0xad943820)
    at ../../../dist/include/xpcom/nsThreadUtils.h:264
#18 0xb7c9280b in nsThread::ProcessNextEvent (this=0xb6c859c0, mayWait=1, 
    result=0xbfd80d74)
    at /home/roc/shared/mozilla-compositor/xpcom/threads/nsThread.cpp:510

p ::DumpJSStack() did something that caused gdb to exit without dumping the stack.
In frame #1 (different run, but stack is the same):

(gdb) p op
$1 = JSOP_LENGTH
(gdb) p js_CodeSpec[op]
$2 = {length = 1 '\001', nuses = 1 '\001', ndefs = 1 '\001', prec = 18 '\022', 
  format = 64}
(gdb) p pcoff
$3 = 0
(In reply to comment #6)
> works for me with a fresh 1.9.2 debug build. Is this one of your code coverage
> customized builds? Can you reproduce with a clean build ?

I hit this every time with a 1.9.2 debug build on OS X (and I just clobbered):

> python _tests/testing/mochitest/runtests.py --console-level=INFO --autorun --test-path=toolkit

...
*** 26 INFO TEST-PASS | /tests/toolkit/components/microformats/tests/test_Microformats.html | date round trip
Assertion failure: js_CodeSpec[op].length >= 1 + pcoff + UINT16_LEN, at /Users/peterv/source/mozilla/central/mozilla/js/src/jsopcode.cpp:147
TEST-UNEXPECTED-FAIL | (automation.py) | Exited with code 6 during test run
...

Can't run full mochitest on a debug build right now.
It's a bogus assertion. Igor, this looks like unexpected fallout from a recent fix you landed. I remember a special case for JSOP_LENGTH -- did it get removed?

/be
Assignee: general → igor
I don't think this blocks release, but obviously important for developers.
Flags: blocking1.9.1? → blocking1.9.1-
Do we have any proof that this assertion only affects debug builds? As far as I know, we don't, and if we don't, it probably affects opt builds too on some testcase, and it's a crash regression, so I argue it should block.
Flags: blocking1.9.1- → blocking1.9.1?
Oh I guess Brendan is saying that the assertion is just wrong and so it would only affect debug builds.
Flags: blocking1.9.1? → blocking1.9.1-
Igor should render a verdict. In the mean time, treat assertions as criticals.

/be
Flags: blocking1.9.1- → blocking1.9.1?
(I'll let Igor adjust the severity or importance or whatever it's called.)
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
(In reply to comment #12)
> It's a bogus assertion. Igor, this looks like unexpected fallout from a recent
> fix you landed. I remember a special case for JSOP_LENGTH -- did it get
> removed?

test_prop_cache has never contained any special check for JSOP_LENGTH since the debug-only code appeared in bug 452693.
Blocks: 452693
Keywords: regression
Attached patch v1Splinter Review
The patch adds the missing JSOP_LENGTH check so test_property_cache uses the same pattern as js_FillPropertyCache and js_FullTestPropertyCache do.
Attachment #375290 - Flags: review?(brendan)
Comment on attachment 375290 [details] [diff] [review]
v1

I know I wrote this code once already (I used the atom local instead of declaring pcatom) but I do not know what became of that code. Oh well, better late than never!

/be
Attachment #375290 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/bf31ea893f39
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/bf31ea893f39
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.