947912 - Assertion failure: !enabled(), at ../vm/SPSProfiler.cpp:43

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 0204febd3146 (run with --fuzzing-safe --ion-eager):


for (var i = 0; i < 2; ++i) {
    function g() {
	enableSPSProfilingAssertions(false)
    }
    g();
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 5b6e82e7bbbf).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "bad" changeset has the timestamp "20140327191048" and the hash "6ea0bf2b69f0".
The "good" changeset has the timestamp "20140327192149" and the hash "d9dc1a7d4649".

Likely fix window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6ea0bf2b69f0&tochange=d9dc1a7d4649

Comment 5

[Christian Holler (:decoder)]

Did bug 914561 maybe fix this?

Comment 6

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Yes, it did.  I ran into this assertion while writing test cases for bug 914561, and changed EnableSPSProfilingAssertions to disable the profiler first (if it was enabled) before setting the stack.