522775 - free list management in bug 505315 has missed a possibility of recursive allocation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

In my patch for bug 505315 I have missed that js_NewFinalizableGCThing can be called recursively. This happens if the function triggers the GC and the GC-end application callback triggers more allocations. Thus the assertion in http://hg.mozilla.org/mozilla-central/file/876738eb9cf0/js/src/jsgc.cpp#l1922 is bogus and the code must be prepared to deal with a possibility of the already allocated free list at that point.

Comment 1

[Igor Bukanov]

Attachment: fix v1

Comment 2

[Jeff Walden [:Waldo]]

(In reply to comment #0)
> This happens if the function triggers the GC and the GC-end
> application callback triggers more allocations.

jsapi-test for this?

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 406765 [details] [diff] [review]
fix v1

>         thing = RefillFinalizableFreeList(cx, thingKind);
>         if (thing) {
>-            JS_ASSERT(!*freeListp);
>+            JS_ASSERT_IF(*freeListp, *freeListp == thing);
>             *freeListp = thing->link;
>             break;

A comment about how the *freeListp non-null situation arises would be great. r=me,

/be

Comment 4

[Igor Bukanov]

landed with extra comments - http://hg.mozilla.org/tracemonkey/rev/eb59dbbc065b

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/eb59dbbc065b

Comment 7

[Johnny Stenback (:jst)]

We're seeing this crash in 3.6b3 (arena_dalloc_small | arena_dalloc | free | JSFreePointerListTask::run(), bug 522880, duped against this bug). Did this ever make it onto the 1.9.2 branch?

Comment 8

[Igor Bukanov]

(In reply to comment #7)
> We're seeing this crash in 3.6b3 (arena_dalloc_small | arena_dalloc | free |
> JSFreePointerListTask::run(), bug 522880, duped against this bug). Did this
> ever make it onto the 1.9.2 branch?

No: this bug is a regression from the bug 505315. That bug is not in 1.9.2.

Comment 9

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Clearing and unaffected per comment 8.