693406 - INFERFLAGS=full causes assertion with multi-compartment tests

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

Attachment: Set the activeAnalysis flag in the proper compartment when printing TypeCompartments from js_DestroyContext with INFERFLAGS=full.

When ISpewResult is enabled, js_DestroyContext walks over all the
compartments and dumps their types. However, it doesn't switch the context
to each compartment as it does so, so the context passed in to all the
print calls may not be in the same compartment as the scripts whose type
inference results it's printing. This means that

    AutoEnterAnalysis enter(cx);

sets the activeAnalysis flag in the wrong compartment, leading to assertion
failures in functions like js::analyze::ScriptAnalysis::slotEscapes.

Comment 1

[Jim Blandy :jimb]

https://hg.mozilla.org/integration/mozilla-inbound/rev/818edd78ffac

Comment 2

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/818edd78ffac