565799 - JM: mochitest-plain crash: /tests/content/events/test/test_bug448602.html

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

We crash on this test.

Comment 1

[David Mandelin [:dmandelin]]

The failure is in a new assertion added for fast globals in JM:

JS_PUBLIC_API(JSBool)
JS_InitStandardClasses(JSContext *cx, JSObject *obj)
{
    JSAtom *atom;

    CHECK_REQUEST(cx);

    JS_ASSERT((obj->getClass()->flags & JSCLASS_GLOBAL_FLAGS) == JSCLASS_GLOBAL_FLAGS);

This test calls _newJSDContext, which calls JS_InitStandardClasses with a global object that has global_class with flags=0. The easy fix would seem to be to make the jsd global class use JSCLASS_GLOBAL_FLAGS. Would that break anything?

Comment 2

[timeless]

ah, wes mentioned that jsd doesn't have that flag and wondered if there were interesting benefits.

iirc he said that not having global meant that jsd bits wouldn't be jit'd which i noted was probably a good thing temporarily until we were more confident about results.

Comment 3

[Wesley W. Garland]

My local JSD fork (mostly timeless' thread-safety patches plus tweaks to play nice with my embedding) has had that flag for a couple of days now -- no observable problems, but I haven't looked very hard either. The shell-based debugger, jsdb -- which is still in CVS -- is also missing that flag.

According to TFS, leaving that flags off will cause "ECMA-262 original prototype behaviour to break", hopefully JSD doesn't rely on that being broken.

Comment 4

[David Mandelin [:dmandelin]]

OK, It looks like we should add that flag in JM as well. I'll just do it on that branch for now. Next week we have an intern starting, Andrew Drake, who will be working on making JM code debuggable, so hopefully he can pick up testing that as well.

Comment 5

[David Mandelin [:dmandelin]]

Attachment: Patch 3

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 445456 [details] [diff] [review]
Patch 3

Maybe a follow-up bug (or just make sure we remember it for our debugging story) that InlineReturn gets inlined, sans debug hook, if there is neither a callobj nor arguments obj.

Comment 7

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/f8c917d2ba48