1717405 - Assertion failure: map->asLinked()->canSkipMarkingTable(), at gc/Marking.cpp:1569

Status: VERIFIED FIXED

(Core :: JavaScript: GC, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20210620-95970359b68e (debug build, run with --fuzzing-safe --ion-offthread-compile=off test.js):

gczeal(4)
for (;;) {
    a = 37
    b = {}
    do {
        c = Math.random()
        b[c] = a--
    } while (a)
}

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x5840a0fc in js::GCMarker::eagerlyMarkChildren(js::PropMap*) ()
#1  0x5844de2e in auto JS::MapGCThingTyped<js::GCMarker::traceBarrieredCell(JS::GCCellPtr)::$_7&>(JS::GCCellPtr, js::GCMarker::traceBarrieredCell(JS::GCCellPtr)::$_7&) ()
#2  0x5841ff28 in js::GCMarker::traceBarrieredCell(JS::GCCellPtr) ()
#3  0x584063aa in js::gc::BarrierTracer::performBarrier(JS::GCCellPtr) ()
#4  0x58406636 in js::gc::PerformIncrementalBarrier(js::gc::TenuredCell*) ()
#5  0x57ea704b in js::SharedPropMap::addPropertyInternal(JSContext*, JS::MutableHandle<js::SharedPropMap*>, unsigned int*, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>) ()
#6  0x57ea6a6b in js::SharedPropMap::addProperty(JSContext*, JSClass const*, JS::MutableHandle<js::SharedPropMap*>, unsigned int*, JS::Handle<JS::PropertyKey>, js::PropertyFlags, js::EnumFlags<js::ObjectFlag>*, unsigned int*) ()
#7  0x57efdcff in js::NativeObject::addProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, js::PropertyFlags, unsigned int*) ()
#8  0x57e76463 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) ()
#9  0x57b532af in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) ()
#10 0x57b4d4aa in js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) ()
#11 0x5894cb54 in js::jit::IonSetPropertyIC::update(JSContext*, JS::Handle<JSScript*>, js::jit::IonSetPropertyIC*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) ()
#12 0x3577929e in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
eax	0x56758d6f	1450544495
ebx	0x590013ec	1493177324
ecx	0x59002d6c	1493183852
edx	0xf7b58cc7	-139096889
esi	0x0	0
edi	0xf04575b0	-263883344
ebp	0xfffd2878	4294781048
esp	0xfffd2840	4294780992
eip	0x5840a0fc <js::GCMarker::eagerlyMarkChildren(js::PropMap*)+1196>
=> 0x5840a0fc <_ZN2js8GCMarker19eagerlyMarkChildrenEPNS_7PropMapE+1196>:	movl   $0x621,0x0
   0x5840a106 <_ZN2js8GCMarker19eagerlyMarkChildrenEPNS_7PropMapE+1206>:	call   0x57a4870e <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Jon Coppeard (:jonco)]

This is probably related to the recent PropMap work.

Comment 3

[Jan de Mooij [:jandem]]

I'll take a look. This is probably a false positive though, the canSkipMarkingTable assertion seems overly strict and keeps biting me when making changes in this area.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1717405 - Trigger pre-barrier before mutating the table. r?jonco!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7aacd5400052
Trigger pre-barrier before mutating the table. r=jonco

Comment 7

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/7aacd5400052

Comment 8

[Intermittent Failures Robot]

2 failures in 3115 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 2

Platform and build breakdown:

• windows10-32-qr: 2
  • debug: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1717405&startday=2021-06-21&endday=2021-06-27&tree=all

Comment 9

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210622212907-536a892dd51f.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 10

[Ted Campbell [:tcampbell]]

This test case seems to be failing intermittently as Bug 1717717