728609 - [IncrementalGC] Crash [@ js::mjit::JITScript::chunkIndex]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on larch branch (incremental GC) revision 1b4a30320120 (options -m -n -a):


var lfcode = new Array();
lfcode.push("\
test();\
function test() {\
  function removeAllProperties(o) {\
    bar() = thaw, patterns;\
  }\
  var o = {};\
  o.first = { toSource: function() { removeAllProperties(o); } };\
  return o.toSource();\
}\
");
lfcode.push("test();");
gczeal(4);
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
                loadFile(file);
}
function loadFile(lfVarx) {
        try {
                        evaluate(lfVarx);
        } catch (lfVare) {      }
}


Crash Trace:

Program received signal SIGSEGV, Segmentation fault.
0x000000000046079a in js::mjit::JITScript::chunkIndex (this=0x0, pc=0xb7228f ":") at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MethodJIT.h:818
818             unsigned offset = pc - script->code;
(gdb) bt 8
#0  0x000000000046079a in js::mjit::JITScript::chunkIndex (this=0x0, pc=0xb7228f ":") at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MethodJIT.h:818
#1  0x000000000046087b in js::mjit::JITScript::chunk (this=0x0, pc=0xb7228f ":") at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MethodJIT.h:831
#2  0x0000000000734da8 in js::VMFrame::chunk (this=0x7fffffff93a0) at ../methodjit/MethodJIT.h:969
#3  0x00000000007364dc in CallCompiler::disable (this=0x7fffffff9360) at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MonoIC.cpp:584
#4  0x00000000007384c3 in CallCompiler::update (this=0x7fffffff9360) at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MonoIC.cpp:972
#5  0x00000000007334ba in js::mjit::ic::Call (f=..., ic=0xb78f98) at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MonoIC.cpp:1018
#6  0x000000000069a48e in JaegerTrampolineReturn () at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MethodJIT.cpp:160
#7  0x000000000069a79e in js::mjit::EnterMethodJIT (cx=0xb6cb30, fp=0x7ffff0beb270, code=0x7ffff7f48cd0, stackLimit=0x7ffff0fcb000, partial=false)
    at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MethodJIT.cpp:1053
#8  0x000000000069aa14 in CheckStackAndEnterMethodJIT (cx=0xb6cb30, fp=0x7ffff0beb270, code=0x7ffff7f48cd0, partial=false)
    at /home/ownhero/homes/mozilla/repos/larch/js/src/methodjit/MethodJIT.cpp:1112


Might be related to bug 728506.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

I was incrementing the gcNumber is StartVerifyBarriers, but not in EndVerifyBarriers, even though they both discard jit code.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/51c51a451762

Comment 5

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/51c51a451762

Comment 6

[Mihaela Velimiroviciu (:mihaelav)]

Ubuntu 11.10 64bit
Build: mozilla-beta-5f412ea09aba
I built Jaegermonkey and ran the test from comment #0: no crash/assertion/failure occured.

Marking verified for firefox 13.

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug728609.js.