Closed Bug 875530 Opened 11 years ago Closed 10 years ago

Crash [@ JS_DumpPCCounts] or Assertion failure: isScriptSource(), at jsscript.h or Assertion failure: is<T>(), at jsobj.h with -D and gcslice

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file stack
The upcoming testcase asserts the following js shell on m-c with --ion-eager -D at Assertion failure: isScriptSource(), at jsscript.h

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1369309413/jsshell-mac64.zip

A variant crashes at DumpPCCounts.

This appeared this morning, assuming also related to bug 870052.
Flags: needinfo?(bhackett1024)
Summary: Crash [@ JS_DumpPCCounts] or Assertion failure: isScriptSource(), at jsscript.h → Crash [@ JS_DumpPCCounts] or Assertion failure: isScriptSource(), at jsscript.h with -D and gcslice
Can you bisect this?  I doubt that 870052 caused this.
Flags: needinfo?(bhackett1024)
(In reply to Brian Hackett (:bhackett) from comment #3)
> Can you bisect this?  I doubt that 870052 caused this.

Nope, I couldn't reproduce on a local build. :(

This morning's pushlog is likely:

https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=63b006573c65

What changeset could have caused this, any idea?
No longer blocks: 870052
Flags: needinfo?(bhackett1024)
Looking at the assertion I would suspect bug 637572, which landed yesterday, but it would be good to confirm / have a reproducible testcase.
Flags: needinfo?(bhackett1024)
Thanks Brian!

Testcases are available and reproducible with the binaries from the link I provided in comment 0.

Jim, this may be related to debugger stuff, do you think this is the case?
Blocks: 637572
Flags: needinfo?(jimb)
I've also sent the testcases to Jim and Eddy via email.
I could reproduce locally now without --enable-more-deterministic, and without --enable-threadsafe:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/88016f09b0f4
user:        Eddy Bruel
date:        Wed May 22 16:23:07 2013 -0700
summary:     Bug 637572 - Use ScriptSourceObject instead of ScriptSource; r=jimb
Flags: needinfo?(ejpbruel)
At the moment I'm focussed on bug 797627, but when that's been settled I'll finish up Debugger.Source, and address this.
Flags: needinfo?(jimb)
Attached file possibly related stack
Assertion failure: is<T>(), at jsobj.h may be a possibly related stack, but the testcase for this was pretty unreliable.
Summary: Crash [@ JS_DumpPCCounts] or Assertion failure: isScriptSource(), at jsscript.h with -D and gcslice → Crash [@ JS_DumpPCCounts] or Assertion failure: isScriptSource(), at jsscript.h or Assertion failure: is<T>(), at jsobj.h with -D and gcslice
Assignee: general → nobody
QA Contact: general
(In reply to Jim Blandy :jimb from comment #10)
> At the moment I'm focussed on bug 797627, but when that's been settled I'll
> finish up Debugger.Source, and address this.

Bug 797627 has been resolved - I'm not sure where the Debugger.Source bug is, but setting needinfo for an update after 8 months. :)
Flags: needinfo?(jimb)
Can you still reproduce this? We've fixed a number of bugs in that area since June.
Flags: needinfo?(jimb)
I just retested. Good point - I don't seem to reproduce anymore. Thanks!
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(ejpbruel)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: