Crash [@ JS::Value::isMarkable]

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
mozilla11
x86
Linux
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test crashes on mozilla-central revision b62e6ee5ba9b (options -m -a -n):


gczeal(4);
function testInterpreterReentry7() {
    var arr = [0, 1, 2, 3, 4];
    for (var i = (1); i < 5; i++)
        arr[i] = "grue";
}
assertEq(testInterpreterReentry7(), "grue bleen");


Backtrace:

==9568== Invalid read of size 4
==9568==    at 0x8058C45: JS::Value::isMarkable() const (jsapi.h:467)
==9568==    by 0x8100CD8: js::gc::MarkValueRaw(JSTracer*, JS::Value const&) (jsgcmark.cpp:462)
==9568==    by 0x8100D72: js::gc::MarkValueUnbarriered(JSTracer*, JS::Value const&, char const*) (jsgcmark.cpp:472)
==9568==    by 0x839B4B2: js::mjit::stubs::WriteBarrier(js::VMFrame&, JS::Value*) (StubCalls.cpp:2558)
==9568==    by 0x4C738DE: ???
==9568==    by 0x8523FF3: ??? (in /srv/repos/mozilla-central/js/src/debug32/shell/js)
==9568==  Address 0x56136c8c is not stack'd, malloc'd or (recently) free'd


This is gczeal(4) only, therefore I assume it's related to incremental GC and not s-s until incremental GC lands.
(Assignee)

Comment 1

6 years ago
Created attachment 575607 [details] [diff] [review]
fix
Attachment #575607 - Flags: review?(bhackett1024)
(Assignee)

Comment 2

6 years ago
Comment on attachment 575607 [details] [diff] [review]
fix

Sometimes I hate bugzilla and it's stupid behavior when you hit enter in the wrong place.
Attachment #575607 - Attachment is obsolete: true
Attachment #575607 - Flags: review?(bhackett1024)
Attachment #575607 - Flags: review+
(Assignee)

Comment 3

6 years ago
Comment on attachment 575607 [details] [diff] [review]
fix

Well, good enough I guess.
Attachment #575607 - Attachment is obsolete: false
(Assignee)

Comment 4

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/88086bed7f10
Target Milestone: --- → mozilla11

Comment 5

6 years ago
https://hg.mozilla.org/mozilla-central/rev/88086bed7f10
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 6

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug703544.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.