839758 - "Assertion failure: isObject(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f() {
    try {
        evalcx("(function(){\
                    return new function(){arguments.callee.caller()}\
                })()", newGlobal())
    } catch (e) {}
}
f()
f()

asserts the following js debug shell on m-c changeset 6a2bebec5914 with -a --ion-range-analysis=off :

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-02-08-mozilla-central-debug/jsshell-mac64.zip

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

No longer occurs with:

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-02-25-mozilla-central-debug/jsshell-mac64.zip

-> WFM.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcase landed via bug 845569.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Reopening.

It still asserts, as per bug 845569 comment 4:

https://tbpl.mozilla.org/php/getParsedLog.php?id=20133306&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20134585&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20135134&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20135761&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20135881&tree=Mozilla-Inbound

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, do you know what could be the cause here? The testcase seems very intermittent.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

As per IRC, requesting to put this unreliable testcase through LangFuzz. Thanks decoder!

Comment 6

[Christian Holler (:decoder)]

Test for mozilla-central 0a91da5f5eab, 64 bit debug+opt build (no options required):


function reportMatch () {}
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
function foo() {
  evaluate("\
    function enterFunc () {}\
    test();\
    function test() {\
      enterFunc (new test('Date.prototype'));\
      function err() {  }\
    }\
  ", { noScriptRval : true });
}
foo();


Trying to bisect it, but this test uses OOM, so probably not very reliable. Fix it while it's hot :D

Comment 7

[Jesse Ruderman]

The original bug involves too-much-recursion rather than OOM.  So the artificial-OOM testcase might demonstrate a different bug.

Comment 8

[Christian Holler (:decoder)]

(In reply to Jesse Ruderman from comment #7)
> The original bug involves too-much-recursion rather than OOM.  So the
> artificial-OOM testcase might demonstrate a different bug.

Not necessarily because artificial OOM and too-much-recursion often trigger the same kind of bugs (I think they use the same check mechanism and both will make the callee return an error, so if the caller doesn't handle that properly, the error will trigger, no matter if it was OOM or TMR).

The stacks in this case are very close to each other too (esp. that #1 goes through js::StackFrame::constructorThis).

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting needinfo from Naveed to find an owner.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This will likely go away when JaegerMonkey goes away after Baseline Compiler is landed in possibly a few weeks' time.

Comment 11

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9d5f05a6d497).

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Will likely be fixed by the upcoming JM removal in bug 857845. (moreover it no longer reproduces, so marking FIXED as a first step)