1127297 - Crash [@ finalize] with --unboxed-objects

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 6bfc0e1c4b29 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --target=i686-pc-linux-gnu --disable-debug, run with --unboxed-objects):

function Foo(a, b) {
    this.a = a;
    this.b = b;
};
var a = [];
for (var i = 0; i < 50; i++)
    a.push(new Foo(i, i + 1));
i = 0;
a[i].c = i;



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xf6ee3b40 (LWP 7021)]
finalize (this=0xf32430d0, fop=0xf6ee3194) at js/src/jsobjinlines.h:53
53	        if (elements->isCopyOnWrite()) {
#0  finalize (this=0xf32430d0, fop=0xf6ee3194) at js/src/jsobjinlines.h:53
#1  finalize<JSObject> (thingSize=144, thingKind=<optimized out>, fop=0xf6ee3194, this=0xf3243000) at js/src/jsgc.cpp:497
#2  FinalizeTypedArenas<JSObject> (fop=0xf6ee3194, src=0xf6ee3154, dest=..., thingKind=thingKind@entry=js::gc::FINALIZE_OBJECT16_BACKGROUND, budget=..., keepArenas=js::gc::ArenaLists::KEEP_ARENAS) at js/src/jsgc.cpp:557
#3  0x08449fc0 in FinalizeArenas (fop=fop@entry=0xf6ee3194, src=src@entry=0xf6ee3154, dest=..., thingKind=thingKind@entry=js::gc::FINALIZE_OBJECT16_BACKGROUND, budget=..., keepArenas=js::gc::ArenaLists::KEEP_ARENAS) at js/src/jsgc.cpp:600
#4  0x0844a18c in js::gc::ArenaLists::backgroundFinalize (fop=fop@entry=0xf6ee3194, listHead=0xf3258000, empty=empty@entry=0xf6ee3188) at js/src/jsgc.cpp:2803
#5  0x0844a386 in js::gc::GCRuntime::sweepBackgroundThings (this=this@entry=0x92eac20, zones=..., threadType=threadType@entry=js::BackgroundThread, freeBlocks=...) at js/src/jsgc.cpp:3332
#6  0x0845557c in js::GCHelperState::doSweep (this=this@entry=0x92f29cc, lock=...) at js/src/jsgc.cpp:3574
#7  0x08455798 in js::GCHelperState::work (this=0x92f29cc) at js/src/jsgc.cpp:3459
#8  0x08156b3b in js::HelperThread::handleGCHelperWorkload (this=this@entry=0x92f8950) at js/src/vm/HelperThreads.cpp:1328
#9  0x0815e850 in js::HelperThread::threadLoop (this=0x92f8950) at js/src/vm/HelperThreads.cpp:1386
#10 0x08153715 in nspr::Thread::ThreadRoutine (arg=0x9305f88) at js/src/vm/PosixNSPR.cpp:45
#11 0xf7fb8d4c in start_thread () from /lib/i386-linux-gnu/libpthread.so.0
#12 0xf7d9c8be in clone () from /lib/i386-linux-gnu/libc.so.6
eax	0x1	1
ebx	0x92d9ff4	153985012
ecx	0xf7e54440	-135969728
edx	0xf32430f0	-215731984
esi	0xf32430d0	-215732016
edi	0xf3244000	-215728128
ebp	0x92afe80 <js::PlainObject::class_>
esp	0xf6ee2810	4142802960
eip	0x84498b0 <FinalizeTypedArenas<JSObject>(js::FreeOp*, js::gc::ArenaHeader**, js::gc::SortedArenaList&, js::gc::AllocKind, js::SliceBudget&, js::gc::ArenaLists::KeepArenasEnum)+800>
=> 0x84498b0 <FinalizeTypedArenas<JSObject>(js::FreeOp*, js::gc::ArenaHeader**, js::gc::SortedArenaList&, js::gc::AllocKind, js::SliceBudget&, js::gc::ArenaLists::KeepArenasEnum)+800>:	testb  $0x4,-0x10(%eax)
   0x84498b4 <FinalizeTypedArenas<JSObject>(js::FreeOp*, js::gc::ArenaHeader**, js::gc::SortedArenaList&, js::gc::AllocKind, js::SliceBudget&, js::gc::ArenaLists::KeepArenasEnum)+804>:	lea    -0x10(%eax),%edx


This particular test only seems to work on 32-bit but I'm also seeing crashes with the same signature and weird crash addresses on 64-bit.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

(--unboxed-objects => bhackett)

Comment 3

[Brian Hackett [Laid off!]]

This WFM on tip, does this still reproduce?  There were several unboxed object bugs fixed after the initial landing of bug 1116855 which could have caused this (crash after convertToNative).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3436787a82d0).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/51ac953371fe
user:        Brian Hackett
date:        Thu Jan 29 11:50:43 2015 -0700
summary:     Bug 1125389 - Fix NewReshapedObject to use the old shape's data, r=jandem.

This iteration took 511.926 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Brian, is it ok to close this as WFM based on comment 4?