"Assertion failure: compartment mismatched,"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

({assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking-fx -)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 517339 [details]
stack

a = evalcx("lazy");
a.watch("x", function() {});
({}).watch("x", function() {});
a.__defineGetter__("y", {});

asserts js debug shell on TM changeset 1c8e91b2e3a4 without -m nor -j at Assertion failure: compartment mismatched,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   63191:aef1f7b0af3e
user:        Steve Fink
date:        Thu Jan 27 18:32:16 2011 -0800
summary:     Bug 631377 - Add some compartment asserts for jsdbgapi (r=gal)
Gary, I can't reproduce this at all (even using changeset 1c8e91b2e3a4).
(Reporter)

Comment 2

7 years ago
(In reply to comment #1)
> Gary, I can't reproduce this at all (even using changeset 1c8e91b2e3a4).

Try passing it in as a CLI argument? I could only get it to assert when doing so, but it still occurs using changeset 80d8431f209e.
Ah, that worked. Weird.
Ok, so this is a problem with SwitchToCompartment: if we ever check the current compartment under one of these auto objects, then we'll assert. The problem is that SwithToCompartment makes cx->compartment not match cx->scopeChain()->compartment(), so checkCompartment is guaranteed to assert. The easiest way to fix this is to wait for dummy frames to die and enter the right compartment properly in DropWatchPointAndUnlock (which is the SwitchCompartment at fault here).

For the record, it appears that the reason that it matters that the testcase is passed on the command line is that it's important that we release the watchpoint on the sandbox object on the main context, and the GC timing/watchpoint release timing happens to work correctly from the command line.
(Reporter)

Updated

7 years ago
blocking-fx: --- → ?

Updated

6 years ago
blocking-fx: ? → -
Blocks: 648746
(Reporter)

Comment 5

6 years ago
FIXED by bug 637985.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   74195:7c43296e7545
user:        Jason Orendorff
date:        Wed Jul 27 17:44:43 2011 -0500
summary:     Bug 637985 - Reimplement watchpoints using a JSObject bit. r=jimb.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Duplicate of this bug: 648746
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.