461274 - TM: Assertion failure: !f->vmprivate

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (jsfunfuzz with a specific seed)

Steps to reproduce:
1. ./js -j e-vmp.js
2. Wait for it to finish (about 3 minutes)

Result: Assertion failure: !f->vmprivate, at jstracer.cpp:2959

Security-sensitive for two reasons: (1) Andreas Gal looked at this in gdb and concluded it was random memory corruption, and (2) the testcase is an unreduced fuzzer.

I'm using Tracemonkey branch rev a21276dd3974, which is current.  I've been hitting this bug occasionally for a few weeks.  I was only able to reproduce it by saving the random number generator seed.

Comment 1

[Andreas Gal :gal]

I think this might be related to the GC bug we are seeing. This seems to be random memory corruption, so we probably want to fix it. danderson and I will try to debug it now. If we can't fix this or it looks unrelated after all, we will switch to https://bugzilla.mozilla.org/show_bug.cgi?id=460875, which is a block (this one is not atm).

Comment 2

[Andreas Gal :gal]

We have difficulties reproducing this now. Its unlikely to be a dup 460875 since that bug is not a random heap painting bug as initially assumed.

Comment 3

[Jesse Ruderman]

Do you want to try to debug this in rev a21276dd3974, bisect until we know which patch "fixed" the testcase, or just mark it as WFM and see if I hit it again?  Last week, I was hitting it about once a day, so if it's still there it shouldn't take too long for me to find it again.

Comment 4

[Daniel Veditz [:dveditz]]

sg:needinfo -- is this one fixed/wfm now or not?

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

I see this somewhat regularly running my own builds of Thunderbird/Shredder from the trunk with chrome jitting turned on.

Comment 6

[Jesse Ruderman]

I say this is WFM.  If anyone is hitting this assertion with other testcases, new bugs should be filed.