708228 - Infinite recursion crash [@ regexp_trace] with incremental GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision fafaf614791f (no options required):


gczeal(4);
var g_rx = /(?:)/;
(3).replace(g_rx.compile("test", "g"), {});


The crash is an infinite recursion with the following repeating part:

#88 0x000000000065a11f in regexp_trace (trc=0xb35108, obj=0x7ffff60088e0) at /srv/repos/mozilla-central/js/src/vm/RegExpObject.cpp:370
#89 0x0000000000443bb2 in JSObject::privateWriteBarrierPre (this=0x7ffff60088e0, old=0x7ffff6008938) at ../jsobjinlines.h:2114
#90 0x000000000044302f in JSObject::setPrivate (this=0x7ffff60088e0, data=0x0) at ../jsobjinlines.h:113
#91 0x000000000065bb0b in js::RegExpObject::setPrivate (this=0x7ffff60088e0, rep=0x0) at ../vm/RegExpObject-inl.h:119
#92 0x000000000065bb59 in js::RegExpObject::purge (this=0x7ffff60088e0, cx=0xb2b930) at ../vm/RegExpObject-inl.h:157
#93 0x000000000065a11f in regexp_trace (trc=0xb35108, obj=0x7ffff60088e0) at /srv/repos/mozilla-central/js/src/vm/RegExpObject.cpp:370

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/projects/larch/rev/6c62c0967631

Comment 3

[Christian Holler (:decoder)]

This crash is on mozilla-central and not on larch only. Please merge to m-c and then mark as fixed again.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: fix

The problem was that we were calling purge when tracing through a regular expression from a write barrier. This seems bad. It does mean that during incremental GC we may fail to purge some regular expressions. This should be rare. I think that's okay, right Chris?

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 581709 [details] [diff] [review]
fix

Review of attachment 581709 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, that's ok: nothing depends on the fact that privates get purged from objects each GC.

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d96b15c1645b

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d96b15c1645b

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug708228.js.