1020800 - Crash [@ JS_AbortIfWrongThread]

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = []
y = new WeakMap
verifyprebarriers()
x[10] = 0
minorgc(true);
x.filterPar(function() {
    y.s
})

crashes js debug shell on m-c changeset 882826199076 with --ion-parallel-compile=off --ion-eager intermittently at JS_AbortIfWrongThread

My configure flags are:

AR=ar sh /home/fuzz2lin/trees/mozilla-central/js/src/configure --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7a1c696cade6
user:        Shu-yu Guo
date:        Mon Apr 07 13:02:20 2014 -0700
summary:     Bug 974201 - Remove filterPar chunking. (r=nmatsakis)

Shu-yu, is bug 974201 a likely regressor?

Setting s-s because gc is on the stack, but not setting a rating yet because I don't know if this is a safe crash.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: Check for correct thread after checking if GC is suppressed. (r=terrence)

Simple bug. This isn't s-s, since GC is still suppressed, so we would've never
ran a minor GC anyways. The thread check was in the wrong place.

r=terrence over IRC.

Comment 2

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bb9909b6258a

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/bb9909b6258a