885769 - Assertion failure: cxArg, at dist/include/js/RootingAPI.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

ParallelArray(4277, (function() {}))

asserts a threadsafe js debug shell on m-c changeset 61c3c8b85563 with --ion-parallel-compile=on at Assertion failure: cxArg, at dist/include/js/RootingAPI.h

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ce7085b63b2b
user:        Bobby Holley
date:        Thu Jun 20 11:05:34 2013 -0700
summary:     Bug 883450 - Assert that we're in a request whenever we create a Rooted<T>. r=terrence

Comment 2

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Hardly.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to its simplicity, actually this is causing a lot of trouble (assorted crash signatures, etc.) in jsfunfuzz.

Comment 4

[Bobby Holley (:bholley)]

It looks like the PJS code is passing null to the Rooted Constructor.

Comment 5

[Shu-yu Guo [:shu]]

This is more than a simple unrooting, in that right now we assume that there is a JSContext available for use inside ParallelArrayAnalysis for operations such as making new template objects while replacing MIR nodes.

I'm working on a patch to separate ParallelArrayAnalysis into 2 phases, one that might potentially need a JSContext, and one that doesn't.

If I can't get that patch done by tonight I'll post a temporary patch for this bug.

Comment 6

[Shu-yu Guo [:shu]]

If fixes for bug 886632 and bug 887002 stick, this will be fixed.