1521001 - Crash [@ JSObject::compartment] or Assertion failure: gc::IsCellPointerValid(value.toGCThing()), at js/src/jit/x86-shared/Assembler-x86-shared.cpp:55

Status: RESOLVED DUPLICATE of bug 1519140

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 081c6ac45c5d (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// jsfunfuzz-generated
options("strict_mode");
try {
    Function `Object.e(this, '')`()
} catch {}
for (v of [0]) {
    schedulegc(this);
}
try {
    // Adapted from randomly chosen test: js/src/jit-test/tests/gc/bug-1515993.js
    Function(`
        var g = newGlobal({
            newCompartment: true
        });
        var dbg = Debugger(g);
        var topLevel;
        dbg.onNewScript = function(s) {
            topLevel = s;
        }
        g.eval('import(1);');
        gczeal(14, 10);
        Object.defineProperty(this, '', {});
    `)();
} catch (e) {}
gczeal(0);
gcslice(1);

Backtrace:

#0 js::jit::AssemblerX86Shared::TraceDataRelocations (trc=0x7f24ad41d668, code=0x1461d48dc038, reader=...) at js/src/jit/x86-shared/Assembler-x86-shared.cpp:54
#1 0x000055d6adae317e in js::jit::JitCode::traceChildren (this=0x1461d48dc038, trc=0x7f24ad41d668) at js/src/jit/Ion.cpp:710
#2 0x000055d6ad817449 in js::GCMarker::processMarkStackTop (this=0x7f24ad41d668, budget=...) at js/src/gc/Marking.cpp:1746
#3 0x000055d6ad7dec6c in js::GCMarker::markUntilBudgetExhausted (this=0x7f24ad41d668, budget=...) at js/src/gc/Marking.cpp:1628
#4 0x000055d6ad809e30 in js::gc::GCRuntime::drainMarkStack (this=<optimized out>) at js/src/gc/GC.cpp:5889
/snip

For detailed crash information, see attachment.

Setting s-s because this is a GC assert. Also crashes opt shells at JSObject::compartment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt shell stack

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/85c9dc639077
user: Jon Coppeard
date: Thu Jan 03 10:06:00 2019 +0000
summary: Bug 1342012 - Store a CCW to the introuction script's script source object r=jandem

Jon, is bug 1342012 a likely regressor?