727921 - "Assertion failure: (ptrBits & 0x7) == 0,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    let(d) {
        yield
    }
})()
eval("\
    (function(){\
        schedulegc(5), 'a'.replace(/a/,function(){yield})\
    })\
")()

asserts js debug shell on m-c changeset ebafee0cea36 with -m, -a and -n at Assertion failure: (ptrBits & 0x7) == 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   86695:fbef6a165cf8
user:        Bill McCloskey
date:        Fri Feb 10 18:32:08 2012 -0800
summary:     Bug 723313 - Stop using conservative stack scanner for VM stack marking (r=luke,bhackett)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Assuming sg:critical and s-s initially after a quick look by billm and I.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Erm, I updated to tip and this seems gone, probably fixed by bug 714109:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   86735:f29587aa8965
user:        Terrence Cole
date:        Mon Feb 13 10:01:18 2012 -0800
summary:     Bug 714109 - Add missing barriers to Generator; r=billm

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I'm going to re-open this, at least until I can triage it. Bug 714109 wasn't intended to fix existing bugs in the tree, so it's more likely that it's just covering up the problem.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

OK, it turns out I was wrong. That patch actually does fix the problem. I pushed a test case here:
  https://hg.mozilla.org/integration/mozilla-inbound/rev/4079180d600c

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

>   https://hg.mozilla.org/integration/mozilla-inbound/rev/4079180d600c

Setting in-testsuite+

Comment 6

[Ed Morley [:emorley]]

(Normally bugs aren't closed until the cset merges from inbound)

https://hg.mozilla.org/mozilla-central/rev/4079180d600c
Followup: https://hg.mozilla.org/mozilla-central/rev/d16c61316cf4

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Test committed with fix, marking verified based on that.