458931 - TM: Crash during GC [@ JS_CallTracer]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

$ cat a3.js

for (let i = 0; i < 3; ++i) { [].concat([]); }
gczeal(2);
({});
gczeal(0); 
var x = {};
for (let j = 0; j < 4; ++j) { x.a = new Date(); }
gc();

$ ~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j a3.js 

Crash [@ JS_CallTracer] dereferencing 0xdadadff0

Comment 1

[Brendan Eich [:brendan]]

WFM (tm tip, on my MBP running leopard) -- who can repro?

/be

Comment 2

[Andreas Gal :gal]

This caused a heap bug in the specific version jesse tested. You might have to go back to it to trigger it again. Jesse, do you remember the changeset id?

Comment 3

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/extensions/regress-458931.js

fix changeset: 20601:0e06273117f5 user: Andreas Gal <[e-mail]> date: Wed Oct 22 19:19:07 2008 -0700 summary: Make sure we set remaining fslots to void in FastNewDate (459628, r=brendan).

Comment 4

[Andreas Gal :gal]

Would make sense looking at your test code and at my fix and the crash behavior. I think bc is right. 

(FastNewDate didn't initialize all fslots, GC comes and scans them => boom)

Comment 5

[Jesse Ruderman]

FIXED by bug 459628, then.

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed mozilla-central, tracemonkey

Comment 7

[Bob Clary [:bc] (inactive)]

when this bug is opened, the test should be checked in.