1543208 - Crash [@ JS::Symbol::isWellKnownSymbol] involving the --gc-zeal runtime flag

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The js shell crashes on mozilla-central revision ec009b98c217 (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion --gc-zeal=2,1) without any testcase.

Backtrace:

#0 JS::Symbol::isWellKnownSymbol (this=0xe4e4e4e4e4e4e4e4) at js/src/vm/SymbolType.h:74
#1 ThingIsPermanentAtomOrWellKnownSymbol (sym=<optimized out>) at js/src/gc/Marking.cpp:175
#2 js::TraceProcessGlobalRoot<JS::Symbol> (trc=0x7f21d0b1c6d0, thing=<optimized out>, name=0x55e1dafecaf6 "well_known_symbol") at js/src/gc/Marking.cpp:492
#3 0x000055e1dc3047f3 in js::TraceWellKnownSymbols (trc=0x7f21d0b1c6d0) at js/src/vm/JSAtom.cpp:469
#4 0x000055e1dc92f468 in js::gc::GCRuntime::traceRuntimeAtoms (this=0x7f21d0b1b6d8, trc=0x7f21d0b1c6d0, access=...) at js/src/gc/RootMarking.cpp:330
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Fuzzing Team]

JSBugMon: Cannot process bug: Error: Failed to isolate test from comment

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/54dffe309994
user: Jon Coppeard
date: Mon Apr 01 18:36:41 2019 +0100
summary: Bug 1540719 - Perform a last ditch GC if symbol allocation fails as we do for most other GC things r=sfink

Jon, is bug 1540719 a likely regressor?

Comment 4

[Steve Fink [:sfink] [:s:]]

Yes, it seems likely. I'll take a look.

Comment 5

[Steve Fink [:sfink] [:s:]]

Attachment: Bug 1543208 - Prevent GC from seeing uninitialized well-known symbols r=jonco

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8428f4ba4a51
Prevent GC from seeing uninitialized well-known symbols r=jonco

Comment 7

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/8428f4ba4a51