Closed Bug 780601 Opened 12 years ago Closed 11 years ago

Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js, test_errorhandler.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: emorley, Assigned: nihsanullah)

References

Details

(Keywords: assertion, intermittent-failure, sec-high, Whiteboard: [js:t])

Attachments

(1 file)

stack
31.99 KB, text/plain
Details
Linux x86-64 mozilla-inbound leak test build on 2012-08-05 06:30:28 PDT for push 85872a2e11db slave: linux64-ix-slave19 https://tbpl.mozilla.org/php/getParsedLog.php?id=14143182&tree=Mozilla-Inbound { TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n | /builds/slave/m-in-lnx64-dbg/build/js/src/jit-test/tests/jaeger/bug557068.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 } Marking s-s since GC.
Linux x86-64 mozilla-inbound leak test build on 2012-08-06 09:13:28 PDT for push 0748aa30bbda slave: linux64-ix-slave20 https://tbpl.mozilla.org/php/getParsedLog.php?id=14161281&tree=Mozilla-Inbound { TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d | /builds/slave/m-in-lnx64-dbg/build/js/src/jit-test/tests/jaeger/bug648708.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 }
Summary: Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
This one got mis-starred; belongs here, not bug 741544 : (In reply to TinderboxPushlog Robot from bug 741544 comment #289) > https://tbpl.mozilla.org/php/getParsedLog.php?id=13977152&tree=Mozilla-Aurora > Linux x86-64 mozilla-aurora leak test build on 2012-07-30 12:17:05 > slave: linux64-ix-slave17 > > TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n | > /builds/slave/m-aurora-lnx64-dbg/build/js/src/jit-test/tests/debug/ > Environment-variables.js: Assertion failure: first - 1 <= last, at > ../../../js/src/gc/Heap.h:340 > make[1]: *** [check-jit-test] Error 2 > make: *** [check] Error 2
Summary: Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
"testcase-wanted" meaning a reliable/reduced one.
Keywords: testcase-wanted
decoder: is this test one of the ones you've run through ASan? Maybe it would identify what's going on with memory here.
(In reply to Daniel Veditz [:dveditz] from comment #4) > decoder: is this test one of the ones you've run through ASan? Maybe it > would identify what's going on with memory here. These tests pass according to the optimized build log of the latest ASan push, so I guess there's not much help from ASan here. Maybe LangFuzz can pick it up by mutating these tests but it hasn't done so far.
https://tbpl.mozilla.org/php/getParsedLog.php?id=14555979&tree=Mozilla-Inbound
Summary: Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
Adding people who sheriff/star things on TBPL, to avoid dupes of this otherwise hidden bug.
Whiteboard: [orange] → [orange][js:t]
Keywords: sec-high
Whiteboard: [orange][js:t] → [js:t]
Naveed - can you find an owner?
Assignee: general → nihsanullah
Attached file stack —
I see an occasional similar assert on jsfunfuzz but do not have a reliable testcase. The stacks I see involve methodjit / JaegerMonkey which I presume might be removed once baseline JIT is finished and ready.
Setting NEEDINFO for Naveed to find an owner.
Flags: needinfo?(nihsanullah)
https://tbpl.mozilla.org/php/getParsedLog.php?id=19977627&tree=Mozilla-Inbound in devtools/webconsole/test/browser_webconsole_bug_601667_filter_buttons.js
Flags: needinfo?(nihsanullah)
Wups, I certainly didn't mean to cancel that needinfo. This crap, having a security bug for starring intermittent failures for SIX LONG MONTHS, absolutely positively needsinfo.
Flags: needinfo?(nihsanullah)
David, any chance you can find someone?
Flags: needinfo?(dmandelin)
If ASan and Valgrind don't help, how about gczeal?
Taking Bill's comment to satisfy immediate needinfos.
Flags: needinfo?(nihsanullah)
Flags: needinfo?(dmandelin)
https://tbpl.mozilla.org/php/getParsedLog.php?id=20154577&tree=Mozilla-Inbound
Summary: Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js, test_errorhandler.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
Looks like a JM bug, and it hasn't happened on trunk since 22.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: