710965 - Intermittent "Assertion failure: (d.lengthAndFlags & FLAGS_MASK) == ROPE_BIT" in ecma_5/JSON/parse-mega-huge-array.js

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=7943186&tree=Try
https://tbpl.mozilla.org/php/getParsedLog.php?id=7942330&tree=Firefox

REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=ecma_5/JSON/parse-mega-huge-array.js | 1411 / 3380 (41%)
++DOMWINDOW == 46 (0x17874f248) [serial = 2738] [outer = 0x118067e90]
667527: JSON.parse should parse arrays of essentially unlimited size
Assertion failure: (d.lengthAndFlags & FLAGS_MASK) == ROPE_BIT, at /builds/slave/m-cen-osx64-dbg/build/js/src/vm/String.h:316
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=ecma_5/JSON/parse-mega-huge-array.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:05:03.226988
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpXVc23Vpidlog
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/jsreftest/tests/jsreftest.html?test=ecma_5/JSON/parse-mega-huge-array.js | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp93YbY3/minidumps/D6A43311-F746-48B5-993A-5DC3EA70D667.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  XUL + 0x1b2e4
    rbx = 0x013f8b60   r12 = 0x00000004   r13 = 0x41e7eec0   r14 = 0x455481d2
    r15 = 0x446261c0   rip = 0x0101b2e4   rsp = 0x5fbfb820   rbp = 0x5fbfb820
    Found by: given as instruction pointer in context
...

(Yeah, I wish I knew why so many of our Mac stacks are garbage these days, too.)

Comment 1

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=7935018&tree=Mozilla-Inbound

Comment 2

[Ed Morley [:emorley]]

Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500