Last Comment Bug 639413 - "Assertion failure: compartment mismatched,"
: "Assertion failure: compartment mismatched,"
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
: 648746 (view as bug list)
Depends on:
Blocks: 630996 648746
  Show dependency treegraph
 
Reported: 2011-03-06 20:24 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 13:56 PST (History)
12 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
-


Attachments
stack (3.06 KB, text/plain)
2011-03-06 20:24 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2011-03-06 20:24:41 PST
Created attachment 517339 [details]
stack

a = evalcx("lazy");
a.watch("x", function() {});
({}).watch("x", function() {});
a.__defineGetter__("y", {});

asserts js debug shell on TM changeset 1c8e91b2e3a4 without -m nor -j at Assertion failure: compartment mismatched,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   63191:aef1f7b0af3e
user:        Steve Fink
date:        Thu Jan 27 18:32:16 2011 -0800
summary:     Bug 631377 - Add some compartment asserts for jsdbgapi (r=gal)
Comment 1 Blake Kaplan (:mrbkap) 2011-03-08 17:30:27 PST
Gary, I can't reproduce this at all (even using changeset 1c8e91b2e3a4).
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-03-08 18:54:04 PST
(In reply to comment #1)
> Gary, I can't reproduce this at all (even using changeset 1c8e91b2e3a4).

Try passing it in as a CLI argument? I could only get it to assert when doing so, but it still occurs using changeset 80d8431f209e.
Comment 3 Blake Kaplan (:mrbkap) 2011-03-11 19:33:46 PST
Ah, that worked. Weird.
Comment 4 Blake Kaplan (:mrbkap) 2011-03-14 10:56:59 PDT
Ok, so this is a problem with SwitchToCompartment: if we ever check the current compartment under one of these auto objects, then we'll assert. The problem is that SwithToCompartment makes cx->compartment not match cx->scopeChain()->compartment(), so checkCompartment is guaranteed to assert. The easiest way to fix this is to wait for dummy frames to die and enter the right compartment properly in DropWatchPointAndUnlock (which is the SwitchCompartment at fault here).

For the record, it appears that the reason that it matters that the testcase is passed on the command line is that it's important that we release the watchpoint on the sandbox object on the main context, and the GC timing/watchpoint release timing happens to work correctly from the command line.
Comment 5 Gary Kwong [:gkw] [:nth10sd] 2011-08-12 02:20:16 PDT
FIXED by bug 637985.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   74195:7c43296e7545
user:        Jason Orendorff
date:        Wed Jul 27 17:44:43 2011 -0500
summary:     Bug 637985 - Reimplement watchpoints using a JSObject bit. r=jimb.
Comment 6 Christian Holler (:decoder) 2011-10-19 03:26:31 PDT
*** Bug 648746 has been marked as a duplicate of this bug. ***
Comment 7 Christian Holler (:decoder) 2013-01-19 13:56:19 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.