864462 - Assertion failure: trc->root, at gc/Verifier.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

An upcoming testcase asserts js debug shell on m-c changeset 2aff2d574a1e with --ion-eager --no-jm --no-ti at Assertion failure: trc->root, at gc/Verifier.cpp

Filing first because this is difficult to reproduce on platforms other than an ARM pandaboard, at least for jsfunfuzz. decoder mentions that Langfuzz might have found this as well.

s-s because GC stuff seem to be involved, at least from the assertion message.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    m = new Map();
    this.n += 'xxx';
    for (var y = 0; y < 9; ++y) {
        for (var z = 0; z < 9; ++z) {
            n += n;
        }
    }
} catch (e) {}
m.set(n);
verifyprebarriers()
print(Array(0x5a827999));

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I was discussing this with billm over IRC just now, so setting needinfo.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I was hoping this was just an OOM, but it looks like it's not. hadOutOfMemory is false for the runtime.

It appears to be some kind of memory corruption. I'm not sure what the next steps are. It's a huge pain to debug.

Comment 4

[Christian Holler (:decoder)]

Here's a second test that reproduces most of the time (if not, then it OOMs):

var BUGNUMBER = '';
function f2(o) {}
function f() {
    verifyprebarriers();
    BUGNUMBER(void 0, f(Int16Array(28800000,-28800)));
}
f();


Valgrind shows nothing unfortunately.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

This turned out to be just an OOM. I should have looked more carefully at the assertion itself. For some reason the debugger was trapping at some other location.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

We should also land the 2 testcases in this case.

Comment 7

[Terrence Cole [:terrence]]

Comment on attachment 741012 [details] [diff] [review]
patch

Review of attachment 741012 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/gc/Verifier.cpp
@@ +511,5 @@
>      /* Make all the roots be edges emanating from the root node. */
>      MarkRuntime(trc);
>  
> +    VerifyNode *node;
> +    node = trc->curnode;

Why this change?

Comment 8

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

> Why this change?

I was getting one of those stupid errors about goto going around a variable initialization.

https://hg.mozilla.org/integration/mozilla-inbound/rev/6b1b8e195cad

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6b1b8e195cad