896126 - Assertion failure: parent, at jswrapper.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

({
    r: function() {
        function f() {
            w[0xe56241c6 >> 3]
        }
    },
    s: function() {
        "use asm"
        return (1 for

asserts js debug shell on m-c changeset 0d0263a58f06 without any CLI arguments at Assertion failure: parent, at jswrapper.cpp

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/d09d109a7e88
user:        Bobby Holley
date:        Wed Jul 17 11:53:52 2013 -0700
summary:     Bug 887334 - Use the new AutoCompartment overload for the atoms compartment and remove AutoEnterAtomsCompartment. r=bhackett

Comment 2

[Christian Holler (:decoder)]

LangFuzz also found tests for this, but they involve gczeal:

gczeal(2,1);
function runTestCase(testcase) {
        $ERROR('Test case returned non-true value!');
}
function newFunc(x) { new Function(x)(); };
newFunc("\
function testcase() {\
  \"use strict\";\
  try {} catch (eval) {}\
}\
runTestCase(testcase);\
");


Marking s-s based on that.

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: same testcase in comment 0

I can reproduce using:

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-07-22-mozilla-central-debug/jsshell-mac64.zip

./js testcase.js

Assertion failure: parent, at ../../../js/src/jswrapper.cpp:35

Comment 5

[Bobby Holley (:bholley)]

Ah, I was doing |./js < testcase.js|. Gary explained IRL that I need to drop the |<|.

Comment 6

[Bobby Holley (:bholley)]

Attachment: Don't wrap pending exceptions into the atoms compartment. v1

Comment 7

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=5ff314641023

Comment 8

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/de1042bf3026

Comment 9

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b717a7945dfb).

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/de1042bf3026

Comment 11

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 12

[Bobby Holley (:bholley)]

https://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?changeset=84b828b63115

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

(In reply to Bobby Holley (:bholley) from comment #12)
> https://hg.mozilla.org/releases/mozilla-aurora/
> pushloghtml?changeset=84b828b63115

Backed out from Aurora for possibly causing xpcshell crashes along with the other changes from bholley's push in https://hg.mozilla.org/releases/mozilla-aurora/rev/659b0d61fbc6

Comment 14

[Bobby Holley (:bholley)]

https://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?changeset=5f9484e134f9

Comment 15

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Backed out for xpcshell failures.
https://hg.mozilla.org/releases/mozilla-aurora/rev/b3d0c2498b42

Comment 16

[Bobby Holley (:bholley)]

https://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?changeset=3266c1d73816

Comment 17

[Al Billings [:abillings - ex-MoCo]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> autoBisect shows this is probably related to the following changeset:
> 
> The first bad revision is:
> changeset:   http://hg.mozilla.org/mozilla-central/rev/d09d109a7e88
> user:        Bobby Holley
> date:        Wed Jul 17 11:53:52 2013 -0700
> summary:     Bug 887334 - Use the new AutoCompartment overload for the atoms
> compartment and remove AutoEnterAtomsCompartment. r=bhackett

If this was the regression, why did this affect Firefox 24? Firefox 25 was trunk then.

Comment 18

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably the wrong regressing bug? bholley might know.

Comment 19

[Bobby Holley (:bholley)]

(In reply to Al Billings [:abillings] from comment #17)
> (In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> > autoBisect shows this is probably related to the following changeset:
> > 
> > The first bad revision is:
> > changeset:   http://hg.mozilla.org/mozilla-central/rev/d09d109a7e88
> > user:        Bobby Holley
> > date:        Wed Jul 17 11:53:52 2013 -0700
> > summary:     Bug 887334 - Use the new AutoCompartment overload for the atoms
> > compartment and remove AutoEnterAtomsCompartment. r=bhackett
> 
> If this was the regression, why did this affect Firefox 24? Firefox 25 was
> trunk then.

Because I backported bug 887334 to 24.

Comment 20

[Daniel Veditz [:dveditz]]

regressing bug was not backported to ESR17 or b2g18