Closed Bug 1020800 Opened 6 years ago Closed 6 years ago

Crash [@ JS_AbortIfWrongThread]

Categories

(Core :: JavaScript: GC, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla32
Tracking Status
firefox32 --- affected

People

(Reporter: gkw, Assigned: shu)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Attachments

(2 files)

Attached file stack
x = []
y = new WeakMap
verifyprebarriers()
x[10] = 0
minorgc(true);
x.filterPar(function() {
    y.s
})

crashes js debug shell on m-c changeset 882826199076 with --ion-parallel-compile=off --ion-eager intermittently at JS_AbortIfWrongThread

My configure flags are:

AR=ar sh /home/fuzz2lin/trees/mozilla-central/js/src/configure --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7a1c696cade6
user:        Shu-yu Guo
date:        Mon Apr 07 13:02:20 2014 -0700
summary:     Bug 974201 - Remove filterPar chunking. (r=nmatsakis)

Shu-yu, is bug 974201 a likely regressor?

Setting s-s because gc is on the stack, but not setting a rating yet because I don't know if this is a safe crash.
Flags: needinfo?(shu)
Simple bug. This isn't s-s, since GC is still suppressed, so we would've never
ran a minor GC anyways. The thread check was in the wrong place.

r=terrence over IRC.
Attachment #8435154 - Flags: review+
Assignee: nobody → shu
Status: NEW → ASSIGNED
Flags: needinfo?(shu)
Group: core-security, javascript-core-security
https://hg.mozilla.org/mozilla-central/rev/bb9909b6258a
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
You need to log in before you can comment on or make changes to this bug.