952409 - Assertion failure: thing->tenuredZone() == trc->zone || trc->runtime->isAtomsZone(thing->tenuredZone()), at jsgc.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: lldb stack

x = 'a'
x += 'b'
fullcompartmentchecks(true)
evaluate("", ({
    global: newGlobal(),
    elementProperty: x
}))

asserts js debug shell on m-c changeset 599100c4ebfe without any CLI arguments at Assertion failure: thing->tenuredZone() == trc->zone || trc->runtime->isAtomsZone(thing->tenuredZone()), at jsgc.cpp

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I think this is also likely related to bug 637572..

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision bfe4ed6d47ce).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/3743ea445b81
user:        Jim Blandy
date:        Wed Jan 22 16:41:15 2014 -0800
summary:     Bug 952885: When doing cross-global compilations in the shell, properly wrap CompileOptions members for the new global. r=njn

Jim, is bug 952885 a likely fix?

Comment 4

[Jim Blandy :jimb]

Yes, that's almost certainly a fix.

Comment 5

[Jim Blandy :jimb]

Although --- please note that you should use 'elementAttributeName', not 'elementProperty', for that regression test, since bug 942251.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting FIXED by bug 952885.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.