756843 - Assertion failure: clasp->flags & (1<<5), at js/src/gc/Marking. cpp:1126

Status: RESOLVED DUPLICATE of bug 756732

(Core :: JavaScript Engine, defect)

Description

[Mark Hammond [:markh] [:mhammond]]

With a clean build of mozilla-central, the browser starts but within 5 second fails with an assertion.  This also happens when running with -safe-mode.  Happens every time (ie, is not intermittent)

Tip is 94434:a0d9e03ba59f.  Does *not* happen with 94119:eea44303caab, but I've not bisected to determine where in that range the error was introduced.

mozconfig:
ac_add_options --enable-application=browser
ac_add_options --disable-angle
ac_add_options --disable-optimize
ac_add_options --enable-debug
ac_add_options --enable-tests
mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@

Compiler: VS2008.

The MSVC debugger tells me that "clasp", "shape" and "type" locals are:
clasp
0x6d33c1e0 struct js::Class js::BlockClass {name=0x6d22ca00 "Block" flags=131585 addProperty=0x6cd06b9f ...}
    name: 0x6d22ca00 "Block"
    flags: 131585
    addProperty: 0x6cd06b9f _JS_PropertyStub
    delProperty: 0x6cd06b9f _JS_PropertyStub
    getProperty: 0x6cd06b9f _JS_PropertyStub
    setProperty: 0x6cd0ea07 _JS_StrictPropertyStub
    enumerate: 0x6cd14c81 _JS_EnumerateStub
    resolve: 0x6cd0fe2f _JS_ResolveStub
    convert: 0x6cd0382d _JS_ConvertStub
    finalize: 0x00000000
    checkAccess: 0x00000000
    call: 0x00000000
    hasInstance: 0x00000000
    construct: 0x00000000
    trace: 0x6cf60f80 block_trace(JSTracer *, JSObject *)
    ext: {equality=0x00000000 outerObject=0x00000000 innerObject=0x00000000 ...}
    ops: {lookupGeneric=0x00000000 lookupProperty=0x00000000 lookupElement=0x00000000 ...}
    pad: 0x6d33c2b4 ""
shape
0x0b708490 {base_={...} propid_={...} slotInfo=486539266 ...}
    js::gc::Cell: {...}
    base_: {...}
    propid_: {...}
    slotInfo: 486539266
    attrs: 5 ''
    flags: 64 '@'
    shortid_: 0
    parent: {...}
    kids: {w=0 }
    listp: 0x00000000
type
0x0b1f1020 {proto={...} singleton={...} flags=2164195336 ...}
    js::gc::Cell: {...}
    proto: {...}
    singleton: {...}
    flags: 2164195336
    contribution: 0
    newScript: {...}
    propertySet: 0x00000000
    interpretedFunction: {...}
    padding: 0x00000000


Stack is:
>	mozjs.dll!js::GCMarker::processMarkStackTop(js::SliceBudget & budget={...})  Line 1126 + 0x30 bytes	C++
 	mozjs.dll!js::GCMarker::drainMarkStack(js::SliceBudget & budget={...})  Line 1173	C++
 	mozjs.dll!IncrementalMarkSlice(JSRuntime * rt=0x072a7e88, __int64 budget=10000, js::JSGCInvocationKind gckind=GC_NORMAL, bool * shouldSweep=0x002ed49f)  Line 3475 + 0x12 bytes	C++
 	mozjs.dll!GCCycle(JSRuntime * rt=0x072a7e88, bool incremental=true, __int64 budget=10000, js::JSGCInvocationKind gckind=GC_NORMAL)  Line 3625 + 0x19 bytes	C++
 	mozjs.dll!Collect(JSRuntime * rt=0x072a7e88, bool incremental=true, __int64 budget=10000, js::JSGCInvocationKind gckind=GC_NORMAL, js::gcreason::Reason reason=CC_WAITING)  Line 3723 + 0x1a bytes	C++
 	mozjs.dll!js::GCSlice(JSRuntime * rt=0x072a7e88, js::JSGCInvocationKind gckind=GC_NORMAL, js::gcreason::Reason reason=CC_WAITING)  Line 3753 + 0x24 bytes	C++
 	mozjs.dll!js::IncrementalGC(JSRuntime * rt=0x072a7e88, js::gcreason::Reason reason=CC_WAITING)  Line 179 + 0xf bytes	C++
 	xul.dll!nsJSContext::GarbageCollectNow(js::gcreason::Reason aReason=CC_WAITING, unsigned int aGckind=0, bool aGlobal=false)  Line 2994 + 0x10 bytes	C++
 	xul.dll!GCTimerFired(nsITimer * aTimer=0x0a26cef8, void * aClosure=0x0000000d)  Line 3166 + 0xd bytes	C++
 	xul.dll!nsTimerImpl::Fire()  Line 508 + 0xe bytes	C++
 	xul.dll!nsTimerEvent::Run()  Line 593	C++
 	xul.dll!nsThread::ProcessNextEvent(bool mayWait=true, bool * result=0x002ed743)  Line 656 + 0x19 bytes	C++
 	xul.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x0031cd28, bool mayWait=true)  Line 245 + 0x17 bytes	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate=0x00317980)  Line 145 + 0xe bytes	C++
 	xul.dll!MessageLoop::RunInternal()  Line 209	C++
 	xul.dll!MessageLoop::RunHandler()  Line 202	C++
 	xul.dll!MessageLoop::Run()  Line 176	C++
 	xul.dll!nsBaseAppShell::Run()  Line 198	C++
 	xul.dll!nsAppShell::Run()  Line 267 + 0x9 bytes	C++
 	xul.dll!nsAppStartup::Run()  Line 296 + 0x1c bytes	C++
 	xul.dll!XREMain::XRE_mainRun()  Line 3792 + 0x22 bytes	C++
 	xul.dll!XREMain::XRE_main(int argc=5, char * * argv=0x00bf9128, const nsXREAppData * aAppData=0x00e5c864)  Line 3869 + 0x8 bytes	C++
 	xul.dll!XRE_main(int argc=5, char * * argv=0x00bf9128, const nsXREAppData * aAppData=0x00e5c864)  Line 3945 + 0x17 bytes	C++
 	firefox.exe!do_main(int argc=5, char * * argv=0x00bf9128)  Line 190 + 0x13 bytes	C++
 	firefox.exe!NS_internal_main(int argc=5, char * * argv=0x00bf9128)  Line 277 + 0xd bytes	C++
 	firefox.exe!wmain(int argc=5, wchar_t * * argv=0x0030e8f8)  Line 107 + 0xd bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 579 + 0x19 bytes	C
 	firefox.exe!wmainCRTStartup()  Line 399	C
 	kernel32.dll!7569f13c() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]	
 	ntdll.dll!7716d819() 	
 	ntdll.dll!7716da2b()