Closed Bug 912379 Opened 6 years ago Closed 6 years ago

Assertion failure: obj == cacheResult, at jscompartmentinlines.h

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla27
Tracking Status
firefox26 --- fixed
firefox27 --- fixed

People

(Reporter: gkw, Assigned: bholley)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack
s = newGlobal();
evalcx("\
    try { \
        throw StopIteration;\
    } catch(a) {\
        x = a;\
    } \
    wrap(x);\
", s);
evalcx("\
    n = x;\
", s);

asserts js debug shell on m-c changeset 7ff96bd19c1c without any CLI arguments at Assertion failure: obj == cacheResult, at jscompartmentinlines.h

My configure flags are:

--target=x86_64-apple-darwin11.4.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/c3c84ce31851
user:        Bobby Holley
date:        Thu Aug 22 12:40:31 2013 -0700
summary:     Bug 907937 - Optimistically check the CCW cache early in opt-build value wrapping. r=billm

This iteration took 340.230 seconds to run.
Bobby, is bug 907937 possibly related?
Flags: needinfo?(bobbyholley+bmo)
The current setup means that we have different cache behavior for StopIteration
depending on whether we're wrapping StopIteration itself or a CCW to one. We
need to maintain cache invariants for optimizations now, so this is verboten.
Shuffle some code.
Attachment #799775 - Flags: review?(mrbkap)
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)
> Bobby, is bug 907937 possibly related?

Yep. Any of these cache coherency bugs are mine.

https://tbpl.mozilla.org/?tree=Try&rev=e55e43d35508
Assignee: general → bobbyholley+bmo
Flags: needinfo?(bobbyholley+bmo)
Attachment #799775 - Flags: review?(mrbkap) → review+
Keywords: checkin-needed
Blocks: 907937
Comment on attachment 799775 [details] [diff] [review]
Unwrap before translating StopIteration. v1

This is a cache-coherency followup from bug 907937. It should have landed before the merge but the reviewer was on PTO. Flagging for m-a approval.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 907937
User impact if declined: Cache coherency issues, crashes
Testing completed (on m-c, etc.): Flagged for m-i checkin
Risk to taking this patch (and alternatives if risky): Very low risk
String or IDL/UUID changes made by this patch: None
Attachment #799775 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/969aeee55c09
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
Attachment #799775 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.