Closed Bug 780601 Opened 7 years ago Closed 6 years ago

Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js, test_errorhandler.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED INCOMPLETE

People

(Reporter: emorley, Assigned: nihsanullah)

References

Details

(Keywords: assertion, intermittent-failure, sec-high, Whiteboard: [js:t])

Attachments

(1 file)

Linux x86-64 mozilla-inbound leak test build on 2012-08-05 06:30:28 PDT for push 85872a2e11db

slave: linux64-ix-slave19

https://tbpl.mozilla.org/php/getParsedLog.php?id=14143182&tree=Mozilla-Inbound

{
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /builds/slave/m-in-lnx64-dbg/build/js/src/jit-test/tests/jaeger/bug557068.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
}

Marking s-s since GC.
Linux x86-64 mozilla-inbound leak test build on 2012-08-06 09:13:28 PDT for push 0748aa30bbda

slave: linux64-ix-slave20

https://tbpl.mozilla.org/php/getParsedLog.php?id=14161281&tree=Mozilla-Inbound

{
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d       | /builds/slave/m-in-lnx64-dbg/build/js/src/jit-test/tests/jaeger/bug648708.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
}
Summary: Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
This one got mis-starred; belongs here, not bug 741544 :

(In reply to TinderboxPushlog Robot from bug 741544 comment #289)
> https://tbpl.mozilla.org/php/getParsedLog.php?id=13977152&tree=Mozilla-Aurora
> Linux x86-64 mozilla-aurora leak test build on 2012-07-30 12:17:05
> slave: linux64-ix-slave17
> 
> TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       |
> /builds/slave/m-aurora-lnx64-dbg/build/js/src/jit-test/tests/debug/
> Environment-variables.js: Assertion failure: first - 1 <= last, at
> ../../../js/src/gc/Heap.h:340
> make[1]: *** [check-jit-test] Error 2
> make: *** [check] Error 2
Summary: Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
"testcase-wanted" meaning a reliable/reduced one.
Keywords: testcase-wanted
decoder: is this test one of the ones you've run through ASan? Maybe it would identify what's going on with memory here.
(In reply to Daniel Veditz [:dveditz] from comment #4)
> decoder: is this test one of the ones you've run through ASan? Maybe it
> would identify what's going on with memory here.

These tests pass according to the optimized build log of the latest ASan push, so I guess there's not much help from ASan here. Maybe LangFuzz can pick it up by mutating these tests but it hasn't done so far.
https://tbpl.mozilla.org/php/getParsedLog.php?id=14555979&tree=Mozilla-Inbound
Summary: Intermittent make check jit_test.py -a -m -d -n | jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
Duplicate of this bug: 785779
Adding people who sheriff/star things on TBPL, to avoid dupes of this otherwise hidden bug.
Whiteboard: [orange] → [orange][js:t]
Whiteboard: [orange][js:t] → [js:t]
Naveed - can you find an owner?
Assignee: general → nihsanullah
Duplicate of this bug: 832613
Attached file stack
I see an occasional similar assert on jsfunfuzz but do not have a reliable testcase.

The stacks I see involve methodjit / JaegerMonkey which I presume might be removed once baseline JIT is finished and ready.
Setting NEEDINFO for Naveed to find an owner.
Flags: needinfo?(nihsanullah)
Duplicate of this bug: 843982
https://tbpl.mozilla.org/php/getParsedLog.php?id=19977627&tree=Mozilla-Inbound in devtools/webconsole/test/browser_webconsole_bug_601667_filter_buttons.js
Flags: needinfo?(nihsanullah)
Wups, I certainly didn't mean to cancel that needinfo. This crap, having a security bug for starring intermittent failures for SIX LONG MONTHS, absolutely positively needsinfo.
Flags: needinfo?(nihsanullah)
David, any chance you can find someone?
Flags: needinfo?(dmandelin)
If ASan and Valgrind don't help, how about gczeal?
Taking Bill's comment to satisfy immediate needinfos.
Flags: needinfo?(nihsanullah)
Flags: needinfo?(dmandelin)
https://tbpl.mozilla.org/php/getParsedLog.php?id=20154577&tree=Mozilla-Inbound
Summary: Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340 → Intermittent make check jit_test.py -a -m -d -n, jit-test/tests/jaeger/bug557068.js, jaeger/bug648708.js, basic/bug688939.js | Environment-variables.js, test_errorhandler.js: Assertion failure: first - 1 <= last, at ../../../js/src/gc/Heap.h:340
Looks like a JM bug, and it hasn't happened on trunk since 22.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.