1921202 - Assertion failure: isTenured(), at src/js/src/gc/Cell.h:312

Status: RESOLVED DUPLICATE of bug 1918438

(Core :: JavaScript Engine, defect, P2)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

Checkout commit 6b6c3965d0a79880493b8ae44a92389b72d90636 and invoke the js shell as follows:

js --fuzzing-safe --gc-zeal=4,77 --no-ggc <testcase>

Actual results:

Assertion failure: isTenured(), at src/js/src/gc/Cell.h:312

==2387024==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x557d28cb5c65 bp 0x7ffe6fec0cd0 sp 0x7ffe6fec0cc0 T2387024)
==2387024==The signal is caused by a WRITE memory access.
==2387024==Hint: address points to the zero page.
    #0 0x557d28cb5c65 in js::gc::Cell::asTenured() js/src/gc/Cell.h:312:3
    #1 0x557d28cb5c65 in CheckEdgeTracer::onChild(JS::GCCellPtr, char const*) js/src/gc/Verifier.cpp:294:23
    #2 0x557d28c3a3e6 in js::gc::TraceEdgeInternal(JSTracer*, JSObject**, char const*) js/src/gc/Tracer.h:109:1
    #3 0x557d28c3a3e6 in auto bool TraceTaggedPtrEdge<JS::Value>(JSTracer*, JS::Value*, char const*)::'lambda'(JS::Value)::operator()<JSObject*>(JS::Value) const js/src/gc/Marking.cpp:682:10
    #4 0x557d28c3a3e6 in auto js::MapGCThingTyped<bool TraceTaggedPtrEdge<JS::Value>(JSTracer*, JS::Value*, char const*)::'lambda'(JS::Value)>(JS::Value const&, JS::Value&&) reproducebuild/dist/include/js/Value.h:1494:28
    #5 0x557d28c0a864 in bool TraceTaggedPtrEdge<JS::Value>(JSTracer*, JS::Value*, char const*) js/src/gc/Marking.cpp:681:16
    #6 0x557d28c0a864 in js::gc::TraceEdgeInternal(JSTracer*, JS::Value*, char const*) js/src/gc/Marking.cpp:701:10
    #7 0x557d282d912b in void js::TraceEdge<JS::Value>(JSTracer*, js::WriteBarriered<JS::Value> const*, char const*) js/src/gc/Tracer.h:150:3
    #8 0x557d282d912b in JSObject::traceChildren(JSTracer*) js/src/vm/JSObject.cpp:3370:9
    #9 0x557d28cb2f3a in _ZZN2JS13TraceChildrenEP8JSTracerNS_9GCCellPtrEENK3$_0clIP8JSObjectEEDaT_ js/src/gc/Tracer.cpp:61:8
    #10 0x557d28cb2f3a in auto JS::MapGCThingTyped<JS::TraceChildren(JSTracer*, JS::GCCellPtr)::$_0>(void*, JS::TraceKind, JS::TraceChildren(JSTracer*, JS::GCCellPtr)::$_0&&) reproducebuild/dist/include/js/TraceKind.h:253:5
    #11 0x557d28cb2f3a in void JS::ApplyGCThingTyped<JS::TraceChildren(JSTracer*, JS::GCCellPtr)::$_0>(void*, JS::TraceKind, JS::TraceChildren(JSTracer*, JS::GCCellPtr)::$_0&&) reproducebuild/dist/include/js/TraceKind.h:268:3
    #12 0x557d28cb2f3a in JS::TraceChildren(JSTracer*, JS::GCCellPtr) js/src/gc/Tracer.cpp:58:3
    #13 0x557d28cb5fd8 in js::gc::GCRuntime::endVerifyPreBarriers() js/src/gc/Verifier.cpp:368:7
    #14 0x557d28bb89dc in js::gc::GCRuntime::setZeal(unsigned char, unsigned int) js/src/gc/GC.cpp:671:5
    #15 0x557d28746d91 in GCZeal(JSContext*, unsigned int, JS::Value*) js/src/builtin/TestingFunctions.cpp:2628:3
    #16 0x557d27f2d1ce in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) js/src/vm/Interpreter.cpp:518:13
    #17 0x557d27f2c42f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:612:12
    #18 0x557d27f44624 in js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) js/src/vm/Interpreter.cpp:684:10
    #19 0x557d27f44624 in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3509:16
    #20 0x557d27f2b431 in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:490:13
    #21 0x557d27f30611 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:877:13
    #22 0x557d27f30e1c in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:910:10
    #23 0x557d2817bf99 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:496:10
    #24 0x557d2817c217 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:520:10
    #25 0x557d27e94f2e in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) js/src/shell/js.cpp:1316:10
    #26 0x557d27e94295 in Process(JSContext*, char const*, bool, FileKind) js/src/shell/js.cpp
    #27 0x557d27e4f17e in ProcessArgs(JSContext*, js::cli::OptionParser*) js/src/shell/js.cpp:11414:10
    #28 0x557d27e4f17e in Shell(JSContext*, js::cli::OptionParser*) js/src/shell/js.cpp:11666:12
    #29 0x557d27e468cd in main js/src/shell/js.cpp:12223:12
    #30 0x7f3f8bebed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #31 0x7f3f8bebee3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #32 0x557d27e0fe78 in _start (reproducebuild/dist/bin/js+0x1c3ae78) (BuildId: bbac1769fe145ec8ccf3443e6763445e)

Comment 1

[Jan de Mooij [:jandem]]

I can reproduce with just:

// --fuzzing-safe --gc-zeal=4,77 --no-ggc
gcparam("nurseryEnabled", true);
const o = {};

Probably caused by enabling the nursery at runtime.

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Jon, any insight on what Jan suggested?
Should we prevent turn the nursery on/off at runtime?

Comment 3

[Jan de Mooij [:jandem]]

I verified that the patch for bug 1918438 fixes this one too.