Bug 52156 – REGRESSION (r75289): Assertion failure in JSC::Heap::destroy() when running JS tests

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Adam Roben (:aroben)]

To reproduce:

1. run-javascriptcore-tests

Three tests will hit an assertion. The tests are:

	js1_5/Regress/regress-152646.js
	js1_5/Regress/regress-192414.js
	js1_5/Regress/regress-96526-002.js

The assertion is in Heap::destroy. It is:

    ASSERT(!m_globalData->dynamicGlobalObject);

m_globalData->dynamicGlobalObject seems always to be 0x01500000.

Here's the backtrace:

>	JavaScriptCore.dll!JSC::Heap::destroy()  Line 90 + 0x28 bytes	C++
 	jsc.exe!cleanupGlobalData(JSC::JSGlobalData * globalData=0x00f2be88)  Line 364	C++
 	jsc.exe!main(int argc=6, char * * argv=0x00cfed00)  Line 356 + 0x9 bytes	C++
 	jsc.exe!__tmainCRTStartup()  Line 597 + 0x17 bytes	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

[Adam Roben (:aroben)]

Is there any way to skip JS tests?

[Adam Roben (:aroben)]

<rdar://problem/8842022>

[Adam Roben (:aroben)]

Looks like run-javascriptcore-tests has support for skipping tests.

[Adam Roben (:aroben)]

I skipped these tests in r75392.

[Adam Roben (:aroben)]

Maybe this was caused by r75289?

[Oliver Hunt]

(In reply to comment #5)
> Maybe this was caused by r75289?

I would guess so, rather than disabling those tests, i think it would be better to rollout that patch.

[Geoffrey Garen]

Yes, please roll out the offending patch.

[Geoffrey Garen]

(...and re-enable the tests.)

[Adam Roben (:aroben)]

I don't know what the offending patch is yet. I'm testing r75289 now.

[Adam Roben (:aroben)]

Rolling out r75289 fixes the assertions.

[Gavin Barraclough]

:-(

[Adam Roben (:aroben)]

Rolled out r75289 and r75392. I commented in bug 26276.