511938 - TM: "Assertion failure: *(uint64*)&global[STOBJ_NSLOTS(JS_GetGlobalForObject(cx, cx->fp->scopeChain))] == 0xdeadbeefdeadbeefLL, at ../jstracer.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function () {
    for (let x = 0; x < 4; ++x) {
        gczeal(2)
    }
})()

asserts dbg js shell on TM branch with -j at Assertion failure: *(uint64*)&global[STOBJ_NSLOTS(JS_GetGlobalForObject(cx, cx->fp->scopeChain))] == 0xdeadbeefdeadbeefLL, at ../jstracer.cpp:5894

Setting security-sensitive due to gczeal.

autoBisect coming up after sleep.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

So I stayed up.

autoBisect shows this is probably related to bug 504478:

The first bad revision is:
changeset:   30365:1440f40669a7
user:        Andreas Gal
date:        Thu Jul 16 18:42:54 2009 -0700
summary:     Shrink slots during GC only, split ReallocSlots into Alloc/Grow/ShrinkSlots (504478, r=igor).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Just talked with Andreas about this. Problem is that we set a poison value using STOBJ_NSLOTS(globalObj), and check it again later. But in between NSLOTS(globalObj) could have changed because of ShrinkSlots.

So, just a bogus assertion. Should be moved to ExecuteTree.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> So, just a bogus assertion. Should be moved to ExecuteTree.

Could this then be easily fixed? It's happening with moderate frequency in jsfunfuzz now...

Comment 4

[Graydon Hoare :graydon]

Attachment: Something like this?

Comment 5

[Andreas Gal :gal]

Looks good.

Comment 8

[Graydon Hoare :graydon]

http://hg.mozilla.org/tracemonkey/rev/38753aa920e8

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/38753aa920e8

Comment 10

[Damon Sicore (:damons)]

Not blocking.

Comment 11

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/d021cc6099c5

Comment 12

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929