All users were logged out of Bugzilla on October 13th, 2018

[jsdbg2] Assertion failure: thing->compartment() == trc->compartment || thing->compartment() == trc->runtime->atomsCompartment || (trc->srcKind == JSTRACE_OBJECT && InCrossCompartmentMap((JSObject *)trc->src, thing, kind)), at jsgc.cpp:3313

RESOLVED FIXED in mozilla20

Status

()

--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla20
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on mozilla-central revision 5cca0408a73f (run with --ion-eager):


var g = newGlobal('new-compartment');
var dbg = new Debugger();
var gw = dbg.addDebuggee(g);
dbg.onDebuggerStatement = function (f) {
	gw.evalInGlobal("eval('var x = \"A Brief History of Love\"');\n")
};
g.eval('debugger');
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 1

6 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   107152:6852b4928efa
user:        Bill McCloskey
date:        Fri Sep 14 17:19:53 2012 -0700
summary:     Bug 790865 - Add more compartment assertions (r=terrence)

This iteration took 100.131 seconds to run.
(Assignee)

Comment 2

6 years ago
If I add this assertion to builtin/Eval.cpp, this testcase flunks it.

 bool
 js::DirectEval(JSContext *cx, const CallArgs &args)
 {
     // Direct eval can assume it was called from an interpreted frame.
     StackFrame *caller = cx->fp();
     JS_ASSERT(IsBuiltinEvalForScope(caller->scopeChain(), args.calleev()));
     JS_ASSERT(JSOp(*cx->regs().pc) == JSOP_EVAL);
+    JS_ASSERT(caller->compartment() == caller->callee().compartment());
 
     if (!WarnOnTooManyArgs(cx, args))
         return false;
 
     return EvalKernel(cx, args, DIRECT_EVAL, caller, caller->scopeChain());
 }
(Assignee)

Updated

6 years ago
Assignee: general → jorendorff
(Assignee)

Comment 3

6 years ago
Created attachment 683828 [details] [diff] [review]
v1
Attachment #683828 - Flags: review?(jimb)

Comment 4

6 years ago
Comment on attachment 683828 [details] [diff] [review]
v1

Review of attachment 683828 [details] [diff] [review]:
-----------------------------------------------------------------

Great!
Attachment #683828 - Flags: review?(jimb) → review+
https://hg.mozilla.org/mozilla-central/rev/f51eb7d2a8de
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.