602155 - stack grows too deep during GC?

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Andreas Gal :gal]

http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1286337661.1286339859.12069.gz&fulltext=1#err1
http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1286339479.1286341515.18818.gz&fulltext=1#err1

Gregor, looks like the stack gets too deep here and we get SIGABRT.

Comment 1

[Andreas Gal :gal]

Observed with the compartments patch queue.

Comment 2

[Igor Bukanov]

The first stack trace contains assureThingIsAligned. This is a debug-only method that does not call any GC-marking. It could be that the stack is damaged.

Comment 3

[Gregor Wagner [:gwagner]]

This stack can't be correct as Igor said.

The summary of the failing test-case is:
var summary = 'Do not assert: fp->slots + fp->script->nfixed + ' +
  'js_ReconstructStackDepth(cx, fp->script, fp->regs->pc) == fp->regs->sp';

Comment 4

[Johnny Stenback (:jst)]

Attachment: Likely beginning of this...

I think I hit this yesterday, a jstestbrowser run eventually got stuck and breaking in gdb showed me this stack. This is the part that was easily captureable, but I still have the core file if more info from it would be helpful.

Comment 5

[Johnny Stenback (:jst)]

The reason for this was actually that the brain transplants branch was leaking everything when running reftests, which lead to a massive heap etc, which lead to an impressive number of things to GC. That's been fixed since, and I'm not sure there's really anything else we need to do here.

Comment 6

[Till Schneidereit [:till]]

Resolving based on comment 5.