1158407 - [jsdbg2] Crash under Debugger::appendAllocationSite

Status: RESOLVED FIXED

(DevTools :: Debugger, defect)

Description

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

STR:

* Load amazon.com
* Open devtools profiler
* Enable "record memory" in profiler options menu
* start recording
* refresh

Comment 1

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

The VM function NewGCObject[0] called by Ion from createThisWithTemplate[1] calls the object metadata hook with a not-yet-fully-initialized JSObject in the nursery that doesn't have its group set yet.

[0] https://dxr.mozilla.org/mozilla-central/source/js/src/jit/VMFunctions.cpp#97
[1] https://dxr.mozilla.org/mozilla-central/source/js/src/jit/CodeGenerator.cpp#4806

Comment 2

[Shu-yu Guo [:shu]]

Not sure how to fix this without duplicating all of masm.initGCThing inside NewGCObject, which is gross.

Comment 3

[Shu-yu Guo [:shu]]

Attachment: Stop using this one weird allocation fallback for MCreateThisWithTemplate.

Comment 4

[Shu-yu Guo [:shu]]

Attachment: Stop using this one weird allocation fallback for MCreateThisWithTemplate.

More cleanup.

Comment 5

[Terrence Cole [:terrence]]

Comment on attachment 8597554 [details] [diff] [review]
Stop using this one weird allocation fallback for MCreateThisWithTemplate.

Review of attachment 8597554 [details] [diff] [review]:
-----------------------------------------------------------------

\o/ It's absolutely *wonderful* to see that go!

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6adf6c6f9794

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6adf6c6f9794