556275 - mops testcase is crashing on linux debugger shell

Status: VERIFIED FIXED

(Tamarin Graveyard :: Garbage Collection (mmGC), defect)

Description

[Brent Baker]

Recent changes for bug 545295 has introduced a failure on linux32 bit (found in the smokes phase of the build).

I was able to reproduce the issue:
using debug-debugger build:
avmshell_sd mops.abc_
Assertion failed: "(((!block->inUse())))" ("/home/build/buildbot/tamarin-redux/linux/repo/MMgc/GCHeap.h":853)

using release-debugger and gdb
avmshell_s
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1211119296 (LWP 24372)]
0x080993cc in MMgc::GCHeap::CreateCommittedBlock ()
(gdb) bt
#0  0x080993cc in MMgc::GCHeap::CreateCommittedBlock ()
#1  0x0809b003 in MMgc::GCHeap::AllocBlock ()
#2  0x0809b685 in MMgc::GCHeap::Alloc ()
#3  0x0808861c in MMgc::GC::AllocBlock ()
#4  0x0809bc11 in MMgc::GCLargeAlloc::Alloc ()
#5  0x080aaae4 in avmplus::AtomArray::checkCapacity ()
#6  0x080ab03d in avmplus::AtomArray::push ()
#7  0x080a9f0d in avmplus::ArrayObject::AS3_push ()
#8  0x080ec640 in avmplus::MethodInfo::debugEnterExitWrapper32 ()

Comment 1

[Brent Baker]

Additional failures with same assert are also happening on linux64 and mac64 running test/performance/language/string/typed/split.abc

Comment 2

[Tommy Reilly]

I'm also seeing this on mac10.5 32 bit so its not just 64 bit

Comment 3

[Lars T Hansen]

Fix coming, here's a preview:

GCHeap.cpp:

@@ -1051,7 +1058,7 @@
                    }
                    
                    // Coalesce with successors
-                    HeapBlock *nextBlock = firstFree + firstFree->size;
+                    HeapBlock *nextBlock = block + block->size;
                    while (totalSize < size + firstSlop && !(nextBlock->inUse() || nextBlock->size == 0)) {

Comment 4

[Lars T Hansen]

tamarin-redux-argo changeset:   3899:9cddce1f5706

Comment 5

[Lars T Hansen]

tamarin-redux changeset:   4252:ae8c50988512

Comment 6

[Brent Baker]

verified fix in tr-argo 3906 and tr 4287