If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

JM: "Assertion failure: kind == GetFinalizableThingTraceKind(str),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Assigned: adrake)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

7 years ago
function f3() {
    try {
        v = f()
    } catch (r) {}
}
function f1(a, t) {
    f2(f, a)
}
function f2() {
    u = uneval()
}
f = (function () {
    Proxy((function () {})(gc()), [])
})
a = ""
f1()
f3(f, a)

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: kind == GetFinalizableThingTraceKind(str), at ../jsgc.cpp:2190
(Assignee)

Comment 1

7 years ago
This is a result of torn values on the stack. There is now a patch in my queue that syncs type whenever data is synced, and it fixes this bug, as well as the simpler test case:

function die() {
  var a = [];
  var b = [];
  var c = a + b;
  c = ({ });
  gc();
}
die();
Assignee: general → adrake
Status: NEW → ASSIGNED
(Assignee)

Comment 2

7 years ago
Created attachment 459606 [details] [diff] [review]
Band-aid patch.
Attachment #459606 - Flags: review?(dvander)
(Assignee)

Comment 3

7 years ago
Created attachment 459610 [details] [diff] [review]
Band-aid patch: now with more context!
Attachment #459606 - Attachment is obsolete: true
Attachment #459610 - Flags: review?(dvander)
Attachment #459606 - Flags: review?(dvander)
Comment on attachment 459610 [details] [diff] [review]
Band-aid patch: now with more context!

I think we need something in `::sync() const` as well... band-aid fine for now since we want conservative GC.
Attachment #459610 - Flags: review?(dvander) → review+
http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/35c51fe530b6
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.