506312 - "Assertion failure: slot == scope->freeslot, at ../jsinterp.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f1() {
    var f = gc
    try {
        f2()
    } catch(e) {}
    gc()
}
function f2() { 
    []({
        t: 0
    })
}
f1()
try {
    f
} catch(e) {
    + e
}
f2()

asserts dbg js shell from TM branch without -j at Assertion failure: slot == scope->freeslot, at ../jsinterp.cpp:6479

autoBisect shows this is probably related to bug 488731 :

The first bad revision is:
changeset:   30616:047b9102dddb
user:        Brendan Eich <[e-mail]>
date:        Thu Jul 23 17:59:49 2009 -0700
summary:     Avoid shape regeneration and property cache purging from the GC unless the shape generator overflows (488731, r=jorendorff).

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix bad bug in patch for bug 488731

Comment 2

[Jason Orendorff [:jorendorff]]

Comment on attachment 390516 [details] [diff] [review]
fix bad bug in patch for bug 488731

ok -- but I think the fact that we don't trace the property cache -- or better, purge property cache entries that refer to dead sprops and objects -- is a different (probably easier) bug than bug 506341.

Comment 3

[Jason Orendorff [:jorendorff]]

(In reply to comment #2)
> (From update of attachment 390516 [details] [diff] [review])
> ok -- but I think the fact that we don't trace the property cache -- or better,
> purge property cache entries that refer to dead sprops and objects -- is a
> different (probably easier) bug than bug 506341.

Hmmm, it appears that is *exactly* what bug 506341 is about. Never mind me!

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/621b8a3eab32

Hope this clears all the orange -- I think it will.

/be

Comment 5

[Robert Sayre]

it did

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/621b8a3eab32

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)

Comment 8

[Christian Holler (:decoder)]

Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.