530507 - Assertion failure: !SPROP_FETCH(spp) - js/src/jsscope.cpp:1231 - thread-safe shell

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

thread-safe shell, tracemonkey

begin test: js1_8/extensions/regress-446169-01.js
BUGNUMBER: 446169
STATUS: Do not assert: Thin_GetWait(tl->owner) in thread-safe build
Assertion failure: !SPROP_FETCH(spp), at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsscope.cpp:1231

Comment 1

[Bob Clary [:bc] (inactive)]

ditto js1_8/extensions/regress-445818.js although randomly.

Comment 2

[Brendan Eich [:brendan]]

Probably mine, can you bisect to the regressing change?

/be

Comment 3

[Bob Clary [:bc] (inactive)]

The first bad revision is:
changeset:   35131:c03ebf340688
user:        Brendan Eich <[e-mail]>
date:        Fri Nov 20 16:14:42 2009 -0800
summary:     Bye-bye middle-deletes and their O(n^2) worst case complexity; hello dictionary-mode scopes (473228, r=jorendorff).

This may explain the flakiness of the jsreftests since then.

Comment 4

[Brendan Eich [:brendan]]

Bob, I can't get the test to fail with xpcshell. I didn't configure a debug js shell with --enable-threadsafe (I can if that is necessary but wanted to ask if you could repro with xpcshell). Results:

$ ./jsDriver.pl -t -e smdebug -s ../../../../tracemonkey.OBJ/dist/bin/xpcshell -l js1_8/extensions/regress-446169-01.js
-*- ARGV is now: -e smdebug -s ../../../../tracemonkey.OBJ/dist/bin/xpcshell -l js1_8/extensions/regress-446169-01.js

-*- opt: adding engine smdebug.
-*- ARGV is now: -s ../../../../tracemonkey.OBJ/dist/bin/xpcshell -l js1_8/extensions/regress-446169-01.js

-*- opt: setting shell path to '../../../../tracemonkey.OBJ/dist/bin/xpcshell'.
-*- ARGV is now: -l js1_8/extensions/regress-446169-01.js

-*- opt: adding test list 'js1_8/extensions/regress-446169-01.js'.
-*- getting test list from user specified source.
-*- Testing engine 'smdebug'
-*- getting spidermonkey engine command.
-*- got '../../../../tracemonkey.OBJ/dist/bin/xpcshell '
-#- Executing 1 test(s).
-*- executing: ../../../../tracemonkey.OBJ/dist/bin/xpcshell  -f ./shell.js -f ./js1_8/shell.js -f ./js1_8/extensions/shell.js -f ./js1_8/extensions/regress-446169-01.js -f ./js-test-driver-end.js
-*- exit code 0, exit signal 0.
-*- Writing output to results-2009-11-25-113309-smdebug.html.
-#- Wrote results to 'results-2009-11-25-113309-smdebug.html'.
-#- 0 test(s) failed

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: gdb session with brendan

Comment 6

[Brendan Eich [:brendan]]

Attachment: tolerate race condition

Thanks to bc for the irc-gdb'ing.

/be

Comment 7

[Jason Orendorff [:jorendorff]]

Comment on attachment 414542 [details] [diff] [review]
tolerate race condition

You could trigger this without JS_THREADSAFE, if we had a badly behaved enough resolve hook.

Comment 8

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/c696751593d6

/be

Comment 9

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b6c848a09518