821551 - "Assertion failure: !InNoGCScope(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function g() {
    z = newGlobal('');
    return function(code) {
        evalcx(code, z)
    }
}
f = g();
f("\
    options('strict_mode');\
    for (var x = 0; x < 1; ++x) {\
        a = x;\
    }\
    options('strict_mode');\
");
f("a in eval");


asserts js debug shell on m-c changeset 020555b69f72 with --ion-eager at Assertion failure: !InNoGCScope(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   115711:9602f98a6a70
user:        Terrence Cole
date:        Wed Dec 05 14:21:44 2012 -0800
summary:     Bug 819118 - Use accessor rather than direct script access; r=billm

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0

I went ahead and just made the relevant methods take Handles and Unrooted this time, I'm not sure why I didn't last time.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 692114 [details] [diff] [review]
v0

Review of attachment 692114 [details] [diff] [review]:
-----------------------------------------------------------------

Let's do this to fix the assertion, but we should do the SuppressGC thing soon.

Comment 3

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4fb4bbc6b029

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/4fb4bbc6b029

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.