683966 - Crash with testcase on Windows 7 involving gc

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

Attached ~50-line testcase crashes js debug shell on m-c changeset 7d3d1c2c75f8 with -m, -a and -d. Because it's on Windows, I don't yet have a stack.

Since this involves gc, I'm locking just-in-case, as per normal.

This was found using a triple combination of an existing js test, jsfunfuzz and jandem's method fuzzer.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

The fix for bug 679461 was disabled when bug 674251 landed.  This is a better fix, closer to the problem --- the debugger shouldn't try to recompile scripts during GC.

Comment 2

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/projects/jaegermonkey/rev/aa9f4b139e38

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 557977 [details] [diff] [review]
patch

Sure, ok.

The comment might be too confident--are we really sure the script is necessarily being destroyed? Perhaps something else is being GC'd and we are calling JS_ClearTrap from a finalize hook.

Skipping recompilation is harmless in any case.

Comment 4

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/mozilla-central/rev/aa9f4b139e38