1126072 - Crash [@ ucol_close_52] or [@ js::gc::Arena::finalize] or [@ js::gc::ArenaLists::queueForegroundObjectsForSweep]

Status: RESOLVED DUPLICATE of bug 949220

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase crashes js debug shell on m-c changeset c0f88b376e33 with  --fuzzing-safe --gc-zeal=14 --no-threads --no-fpu --no-asmjs --no-baseline --ion-eager at ucol_close_52 with js::gc::Arena::finalize and js::gc::ArenaLists::queueForegroundObjectsForSweep on the stack.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/fuzz2/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --disable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Not sure exactly what issue this is, so setting needinfo? from Jon as a start, since this seems related to compacting GC, also setting s-s.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

:decoder mentioned over IRC that this might be bug 949220.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Confirmed by :Waldo in person. Opening up.