728506 - [IncrementalGC] Crash [@ js::mjit::JITScript::chunkIndex] with verifybarriers

Status: RESOLVED DUPLICATE of bug 728609

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function tryItOut(code) {
    try {} catch (a) {}
    function a(e) {}
    n = code
    b = code
    sandboxResult(b, "same-compartment");
    z = sandboxResult(b, "same-compartment");
}
function sandboxResult(code, globalType) {
    var result
    try {
        var sandbox = newGlobal(globalType)
        evalcx(code, sandbox)
        if (typeof result != "ob") {
            +result
        }
    } catch (e) {}
}(function() {}())
tryItOut("\
    verifybarriers();\
    function c(){} \
    uneval(          )\
");


crashes js debug shell on larch changeset 5580e7e94b1a with -m and -a at js::mjit::JITScript::chunkIndex

Setting s-s because incremental GC bugs & verifybarriers sound scary.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Pass the testcase in as a CLI argument to reproduce the crash.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

-> sg:nse

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> -> sg:nse

(because it's a bug in the verifier, as per bug 729364 comment 1, both this bug and bug 729364 are marked as duplicates of the same bug)

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 728609).