729364 - [IncrementalGC] Crash [@ js::mjit::JITScript::chunkIndex] or "Assertion failure: m_value," with verifybarriers

Status: RESOLVED DUPLICATE of bug 728609

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f() {
  try {} catch (e) {}
}
function g(code) {
  function m() {
    return "(function(){return " + code + "})()"
  }
  var codeNestedDeep = m(codeNestedDeep)
  h(m(code), "same-compartment")
  h(codeNestedDeep, "same-compartment")
}
function h(code, globalType) {
  try {
    evalcx(code, newGlobal(globalType))
  } catch (e) {
    "" + f()
  }
}
function p()(function() function() {})
g("print(let(x=verifybarriers(),q)((x(\"\",l('')))?(\"\"):(\"\")))()")


The upcoming attached testcase asserts js debug shell on m-c changeset 9bde0d25d76e with -m, -a and -n at Assertion failure: m_value, and sometimes crashes instead at js::mjit::JITScript::chunkIndex

Pass the testcase as a CLI argument to reproduce the assert. Paste the testcase in to get the crash.

verifybarriers is present -> locking s-s and assuming [sg:critical] prior to diagnosis.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Not s-s because it's a bug in the verifier.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Not s-s because it's a bug in the verifier.

-> sg:nse

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug729364.js.