709909 - [IncrementalGC] Crash [@ JSObject::finalize]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function tryItOut(code) {
    f = eval("(function(){" + code + "})");
    f()
}
function z(x, n) {
    for (;;) {
        x = {
            a: x
        };
    }
}
tryItOut("\
    for (l in [0]) {\
        z()\
    }\
");


crashes js opt shell on larch changeset 341396ef32a8 with -m and -a at JSObject::finalize

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81489:ca2d2123be37
user:        Bill McCloskey
date:        Thu Dec 08 17:38:53 2011 -0800
summary:     [INCREMENTAL] Fix bug 708741

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/projects/larch/rev/43f95de7b6b8

This crashed for me, but with a different stack trace. However, it was a memory corruption bug, so I guess it's not surprising. I'm going to optimistically mark this as fixed. Gary, if you have time, you could backport this patch over the crashing revision and see if the crash goes away. However, I don't think that's strictly necessary.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Most of the testcases crashing at this signature did not crash anymore with latest larch tip, so yes, I think this has been fixed.