Assertion failure: static_cast<gc::Cell*>(val.toGCThing())->isTenured(), at jit/shared/Assembler-x86-shared.h:151

RESOLVED DUPLICATE of bug 1023158

Status

()

--
critical
RESOLVED DUPLICATE of bug 1023158
4 years ago
2 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(firefox34 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision cd2acc7ab2f8 (run with --no-threads --fuzzing-safe --ion-eager):


function c() {
    this.x = 3;
}
Object.prototype.__defineSetter__('x', (function() {
    "use asm"
    function prototype(){}
    return prototype;
}))
new c;
(Reporter)

Comment 1

4 years ago
Created attachment 8477721 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 2

4 years ago
Marking s-s because this is a GC-related assertion. Needinfo from luke since it includes ASM.js.
status-firefox34: --- → affected
Flags: needinfo?(luke)
Whiteboard: [jsbugmon:update,bisect]

Comment 3

4 years ago
I think this is another instance of the isTenured() assert we saw in the other bug (I don't have the bug # handy).  As with that bug, I think asm.js is just tickling the bug by putting a native in a place there are usually only interpreted functions.  I assume it's the same type of fix.
Flags: needinfo?(luke)
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 4

4 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/36814bee6277
user:        Brian Hackett
date:        Mon Aug 11 08:40:26 2014 -0800
summary:     Bug 1023158 - Add writeDataRelocation() call, r=jandem.

This iteration took 368.731 seconds to run.
(Reporter)

Comment 5

4 years ago
Needinfo from Brian based on comment 4 :)
Flags: needinfo?(bhackett1024)
That patch didn't cause this bug, it just exposed an underlying issue which we weren't asserting before.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → DUPLICATE
Duplicate of bug: 1023158

Updated

3 years ago
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.