800586 - [jsdbg2] Assertion failure: thing->compartment() == trc->compartment || thing->compartment() == trc->runtime->atomsCompartment || (trc->srcKind == JSTRACE_OBJECT && InCrossCompartmentMap((JSObject *)trc->src, thing, kind)), at jsgc.cpp:3313

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 5cca0408a73f (run with --ion-eager):


var g = newGlobal('new-compartment');
var dbg = new Debugger();
var gw = dbg.addDebuggee(g);
dbg.onDebuggerStatement = function (f) {
	gw.evalInGlobal("eval('var x = \"A Brief History of Love\"');\n")
};
g.eval('debugger');

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   107152:6852b4928efa
user:        Bill McCloskey
date:        Fri Sep 14 17:19:53 2012 -0700
summary:     Bug 790865 - Add more compartment assertions (r=terrence)

This iteration took 100.131 seconds to run.

Comment 2

[Jason Orendorff [:jorendorff]]

If I add this assertion to builtin/Eval.cpp, this testcase flunks it.

 bool
 js::DirectEval(JSContext *cx, const CallArgs &args)
 {
     // Direct eval can assume it was called from an interpreted frame.
     StackFrame *caller = cx->fp();
     JS_ASSERT(IsBuiltinEvalForScope(caller->scopeChain(), args.calleev()));
     JS_ASSERT(JSOp(*cx->regs().pc) == JSOP_EVAL);
+    JS_ASSERT(caller->compartment() == caller->callee().compartment());
 
     if (!WarnOnTooManyArgs(cx, args))
         return false;
 
     return EvalKernel(cx, args, DIRECT_EVAL, caller, caller->scopeChain());
 }

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 4

[Jim Blandy :jimb]

Comment on attachment 683828 [details] [diff] [review]
v1

Review of attachment 683828 [details] [diff] [review]:
-----------------------------------------------------------------

Great!

Comment 5

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f51eb7d2a8de

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f51eb7d2a8de