738065 - Assertion failure: (ptrBits & 0x7) == 0, at ../../jsval.h:767 or Crash [@ js::HeapPtr<js::types::TypeObject, unsigned long>::operator->]

Status: RESOLVED DUPLICATE of bug 737388

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Test case for shell (run with -n -m)

The attached test asserts/crashes on mozilla-central revision 58a2cd0203ee (options -m -n).


Crash trace:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000413ade in js::HeapPtr<js::types::TypeObject, unsigned long>::operator-> (this=0x7fff0000000a) at ../../gc/Barrier.h:212
212         T *operator->() const { return value; }
(gdb) x /2i $pc
=> 0x413ade <js::HeapPtr<js::types::TypeObject, unsigned long>::operator->() const+12>: mov    (%rax),%rax
   0x413ae1 <js::HeapPtr<js::types::TypeObject, unsigned long>::operator->() const+15>: leaveq 
(gdb) info register rax
rax            0x7fff0000000a   140733193388042
(gdb) bt
#0  0x0000000000413ade in js::HeapPtr<js::types::TypeObject, unsigned long>::operator-> (this=0x7fff0000000a) at ../../gc/Barrier.h:212
#1  0x0000000000405970 in js::ObjectImpl::hasSingletonType (this=0x7fff00000002) at ../../vm/ObjectImpl.h:210
#2  0x000000000044e494 in js::types::Type::ObjectType (obj=0x7fff00000002) at ../jsinferinlines.h:65
#3  0x000000000044e54f in js::types::GetValueType (cx=0xb76a80, val=...) at ../jsinferinlines.h:91
#4  0x00000000004e40d1 in js::types::TypeMonitorResult (cx=0xb76a80, script=0x7ffff61079a8, pc=0xb7d2a5 "7Qg", rval=...) at /srv/repos/mozilla-central/js/src/jsinfer.cpp:4941
#5  0x00000000004f60f6 in js::types::TypeScript::Monitor (cx=0xb76a80, script=0x7ffff61079a8, pc=0xb7d2a5 "7Qg", rval=...) at ../jsinferinlines.h:574
#6  0x00000000007930d9 in js::mjit::stubs::TypeBarrierHelper (f=..., which=0) at /srv/repos/mozilla-central/js/src/methodjit/StubCalls.cpp:1650
#7  0x00007ffff7f2efe3 in ?? ()

Comment 2

[Luke Wagner [:luke]]

(Fixed on m-i)