639413 - "Assertion failure: compartment mismatched,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = evalcx("lazy");
a.watch("x", function() {});
({}).watch("x", function() {});
a.__defineGetter__("y", {});

asserts js debug shell on TM changeset 1c8e91b2e3a4 without -m nor -j at Assertion failure: compartment mismatched,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   63191:aef1f7b0af3e
user:        Steve Fink
date:        Thu Jan 27 18:32:16 2011 -0800
summary:     Bug 631377 - Add some compartment asserts for jsdbgapi (r=gal)

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Gary, I can't reproduce this at all (even using changeset 1c8e91b2e3a4).

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> Gary, I can't reproduce this at all (even using changeset 1c8e91b2e3a4).

Try passing it in as a CLI argument? I could only get it to assert when doing so, but it still occurs using changeset 80d8431f209e.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Ah, that worked. Weird.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Ok, so this is a problem with SwitchToCompartment: if we ever check the current compartment under one of these auto objects, then we'll assert. The problem is that SwithToCompartment makes cx->compartment not match cx->scopeChain()->compartment(), so checkCompartment is guaranteed to assert. The easiest way to fix this is to wait for dummy frames to die and enter the right compartment properly in DropWatchPointAndUnlock (which is the SwitchCompartment at fault here).

For the record, it appears that the reason that it matters that the testcase is passed on the command line is that it's important that we release the watchpoint on the sandbox object on the main context, and the GC timing/watchpoint release timing happens to work correctly from the command line.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

FIXED by bug 637985.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   74195:7c43296e7545
user:        Jason Orendorff
date:        Wed Jul 27 17:44:43 2011 -0500
summary:     Bug 637985 - Reimplement watchpoints using a JSObject bit. r=jimb.

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929