951285 - Assertion failure: js::CurrentThreadCanReadCompilationData(), at jsfun.h

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: lldb stack

function f(input) {
    for (var k = 0; k < 999; k++) {
        input();
    }
}
g = (function(x) {
    ff = x.ff;
    return (function() {
        ff()
    });
})({
    ff: (function() {
        'fa'.replace(/a/g, String.localeCompare)
    })
});
f(g);

asserts js debug shell on m-c changeset d58545aaeab9 with -D at Assertion failure: js::CurrentThreadCanReadCompilationData(), at jsfun.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

=== Tinderbox Build Bisection Results ===

Last "good" changeset has timestamp "20131216104657" and the hash "3df0585a23a1"
First "bad" changeset has timestamp "20131216105355" and the hash "dbeea0e93b56"

Likely regression window: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=3df0585a23a1&tochange=dbeea0e93b56


Regression window only has bug 785905 in it. Brian, is it a likely regressor?

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/07df5b26051d

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/07df5b26051d

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.