926448 - [jsdbg2] Assertion failure: table or Assertion failure: object->runtimeFromMainThread()->isHeapBusy(), at vm/Debugger.cpp:385 or Crash [@ js_free] with Debugger

Status: RESOLVED DUPLICATE of bug 942480

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 211337f7fb83 (run with --fuzzing-safe):


function attach(i) {
   var dbg = Debugger();
}
for (var i = 0; i < 4000000; i++)
    attach(i);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Jason Orendorff [:jorendorff]]

Can't reproduce on Mac. Tried both debug and debug-threadsafe builds of 211337f7fb83.

Comment 3

[Jason Orendorff [:jorendorff]]

Still cant' repro on Mac, even with kind words and encouragement from decoder on IRC. :)

jimb, does it happen for you? Can you investigate a bit?

Comment 4

[Christian Holler (:decoder)]

Note that I only tested this with --enable-optimize (even for debug builds). Not sure if it matters here.

Comment 5

[Jim Blandy :jimb]

This doesn't assert for me. But it does fail to trigger GC in the shell, and the process grows until the kernel kills it.

Comment 6

[Jim Blandy :jimb]

While I wasn't able to reproduce the assertion, I filed bug 926678 and bug 926681 for failing to call GC.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9c90bda44992
user:        Brian Hackett
date:        Thu Aug 15 07:33:30 2013 -0700
summary:     Bug 864220 - Use mprotect to trigger interrupts in Ion compiled code, r=luke,jandem.

This iteration took 221.381 seconds to run.

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0204febd3146).

Comment 9

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/521a84fc4f6f
user:        Jim Blandy
date:        Sun Dec 08 15:53:28 2013 -0800
summary:     Bug 942480: Don't js_delete a freshly allocated js::Debugger, if we've stored it in the Debugger JSObject's private slot. r=shu

This iteration took 359.795 seconds to run.