875530 - Crash [@ JS_DumpPCCounts] or Assertion failure: isScriptSource(), at jsscript.h or Assertion failure: is<T>(), at jsobj.h with -D and gcslice

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase asserts the following js shell on m-c with --ion-eager -D at Assertion failure: isScriptSource(), at jsscript.h

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1369309413/jsshell-mac64.zip

A variant crashes at DumpPCCounts.

This appeared this morning, assuming also related to bug 870052.

Comment 3

[Brian Hackett [Laid off!]]

Can you bisect this?  I doubt that 870052 caused this.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Brian Hackett (:bhackett) from comment #3)
> Can you bisect this?  I doubt that 870052 caused this.

Nope, I couldn't reproduce on a local build. :(

This morning's pushlog is likely:

https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=63b006573c65

What changeset could have caused this, any idea?

Comment 5

[Brian Hackett [Laid off!]]

Looking at the assertion I would suspect bug 637572, which landed yesterday, but it would be good to confirm / have a reproducible testcase.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Thanks Brian!

Testcases are available and reproducible with the binaries from the link I provided in comment 0.

Jim, this may be related to debugger stuff, do you think this is the case?

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've also sent the testcases to Jim and Eddy via email.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I can still reproduce using:

https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-06-07-mozilla-central-debug/jsshell-mac64.zip

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I could reproduce locally now without --enable-more-deterministic, and without --enable-threadsafe:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/88016f09b0f4
user:        Eddy Bruel
date:        Wed May 22 16:23:07 2013 -0700
summary:     Bug 637572 - Use ScriptSourceObject instead of ScriptSource; r=jimb

Comment 10

[Jim Blandy :jimb]

At the moment I'm focussed on bug 797627, but when that's been settled I'll finish up Debugger.Source, and address this.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: possibly related stack

Assertion failure: is<T>(), at jsobj.h may be a possibly related stack, but the testcase for this was pretty unreliable.

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jim Blandy :jimb from comment #10)
> At the moment I'm focussed on bug 797627, but when that's been settled I'll
> finish up Debugger.Source, and address this.

Bug 797627 has been resolved - I'm not sure where the Debugger.Source bug is, but setting needinfo for an update after 8 months. :)

Comment 13

[Jim Blandy :jimb]

Can you still reproduce this? We've fixed a number of bugs in that area since June.

Comment 14

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I just retested. Good point - I don't seem to reproduce anymore. Thanks!