688939 - Assertion failure: script->ownerObject == owner, at jsscript.cpp:309

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 959c1e6bdb11 (options -m -n -a):


gczeal(2);
string=""
for (var i = 0; i < 100; i++ )
  hex=newGlobal('same-compartment');


S-s for now because this is GC related.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

I got this too in jsfunfuzz.

Comment 2

[Jesse Ruderman]

And I get this in the browser with RandomJS. (My testcase also uses gczeal.)

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: fix

This was a bogus assertion, unfortunately. The setOwnerObject call was supposed to happen right after setting u.i.script. But that inadvertently got broken in a few places. I've added a setter to make it less likely for this to happen again.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Also, not S-S. Except for the assertion, the code was fine.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f7cf12c7ae38

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f7cf12c7ae38

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug688939.js.