580694 - JM: "Assertion failure: kind == GetFinalizableThingTraceKind(str),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f3() {
    try {
        v = f()
    } catch (r) {}
}
function f1(a, t) {
    f2(f, a)
}
function f2() {
    u = uneval()
}
f = (function () {
    Proxy((function () {})(gc()), [])
})
a = ""
f1()
f3(f, a)

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: kind == GetFinalizableThingTraceKind(str), at ../jsgc.cpp:2190

Comment 1

[Andrew Drake [:adrake]]

This is a result of torn values on the stack. There is now a patch in my queue that syncs type whenever data is synced, and it fixes this bug, as well as the simpler test case:

function die() {
  var a = [];
  var b = [];
  var c = a + b;
  c = ({ });
  gc();
}
die();

Comment 2

[Andrew Drake [:adrake]]

Attachment: Band-aid patch.

Comment 3

[Andrew Drake [:adrake]]

Attachment: Band-aid patch: now with more context!

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 459610 [details] [diff] [review]
Band-aid patch: now with more context!

I think we need something in `::sync() const` as well... band-aid fine for now since we want conservative GC.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/35c51fe530b6

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929