661840 - TI: "Assertion failure: addr % Cell::CellSize == 0,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f(a) {}
s = [{
  s: [],
  s: function(d, b) {},
  t: function() {
    try {} catch (e) {}
  }
}, {
  t: "",
  s: [],
  s: function(d, b) {}
}, {
  t: "",
  s: [],
  s: function(d, b) {},
  t: function() {}
}, {
  t: "",
  x: "",
  s: [],
  g: function(b) {},
  t: function(f) {}
}, {
  t: "",
  s: [],
  s: function() {}
}];
v = 0
Function("gc(evalcx('lazy'))")();
gczeal();
gc();
(function() {
  x
})()

asserts js debug shell on JM changeset 11714be33655 with -n at Assertion failure: addr % Cell::CellSize == 0, when the testcase is passed in as a CLI argument.

Comment 1

[Brian Hackett [Laid off!]]

Fixed as part of rev a638ecbe6843.  During a compartment GC it is possible to call js_TraceScript on scripts outside the target compartment, and in such cases we would mark any type objects in a list attached to the script (objects for initializers within the script, etc.).  The mark bit would stay set until the next major GC, when we saw the bit and incorrectly thought that the objects/shapes/etc. in the type object had already been traced.  The fix (discussed with billm on IRC) has js_TraceScript detect this situation and do no tracing at all in such cases.

Comment 3

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929