The default bug view has changed. See this FAQ.

INFERFLAGS=full causes assertion with multi-compartment tests

RESOLVED FIXED in mozilla10

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jimb, Unassigned)

Tracking

unspecified
mozilla10
x86_64
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [inbound])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 566006 [details] [diff] [review]
Set the activeAnalysis flag in the proper compartment when printing TypeCompartments from js_DestroyContext with INFERFLAGS=full.

When ISpewResult is enabled, js_DestroyContext walks over all the
compartments and dumps their types. However, it doesn't switch the context
to each compartment as it does so, so the context passed in to all the
print calls may not be in the same compartment as the scripts whose type
inference results it's printing. This means that

    AutoEnterAnalysis enter(cx);

sets the activeAnalysis flag in the wrong compartment, leading to assertion
failures in functions like js::analyze::ScriptAnalysis::slotEscapes.
Attachment #566006 - Flags: review?(bhackett1024)
Attachment #566006 - Flags: review?(bhackett1024) → review+
(Reporter)

Comment 1

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/818edd78ffac
Status: NEW → ASSIGNED
Whiteboard: [inbound]
https://hg.mozilla.org/mozilla-central/rev/818edd78ffac
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
You need to log in before you can comment on or make changes to this bug.