754716 - IonMonkey: Crash [@ js::gc::Cell::compartment]

Status: RESOLVED DUPLICATE of bug 754714

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on ionmonkey revision e8de64e7e9fe (run with --ion -n -m):


evaluate("\
gczeal(2);\
function F(x, y) { }\
function test(N) {\
  var src = F.toSource(-1)+\"\
\";\
  src = Array(N + 1).join(src);\
  src = src.replace(/F/g, function() { \
\tfor ( var Array = (4 - N.length ); Array > 0; Array-- ) {} \
  });\
}\
var data = {X:[], Y:[]};\
for (var i = 0; i != 10; ++i)\
  data.Y.push(test(1000 + i * 2000));\
");

Comment 1

[Christian Holler (:decoder)]

Crash trace:

Program received signal SIGSEGV, Segmentation fault.
0x000000000040556e in js::gc::Cell::compartment (this=0xfff88000000003e8) at ../../gc/Heap.h:970
970         return arenaHeader()->compartment;
Missing separate debuginfos, use: debuginfo-install libgcc-4.4.6-3.el6.x86_64 libstdc++-4.4.6-3.el6.x86_64
(gdb) bt 8
#0  0x000000000040556e in js::gc::Cell::compartment (this=0xfff88000000003e8) at ../../gc/Heap.h:970
#1  0x00000000006f757f in js::gc::CheckMarkedThing<JSString> (trc=0x7ffff7fb4228, thing=0xfff88000000003e8) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/gc/Marking.cpp:83
#2  0x00000000006f590a in js::gc::MarkInternal<JSString> (trc=0x7ffff7fb4228, thingp=0x7fffffffa768) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/gc/Marking.cpp:105
#3  0x00000000006f47c8 in js::gc::MarkRoot<JSString> (trc=0x7ffff7fb4228, thingp=0x7fffffffa768, name=0x99394c "ion-vm-args") at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/gc/Marking.cpp:153
#4  0x00000000006ef34b in js::gc::MarkStringRoot (trc=0x7ffff7fb4228, thingp=0x7fffffffa768, name=0x99394c "ion-vm-args") at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/gc/Marking.cpp:217
#5  0x0000000000807c32 in MarkIonExitFrame (trc=0x7ffff7fb4228, frame=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonFrames.cpp:533
#6  0x0000000000807d15 in MarkIonActivation (trc=0x7ffff7fb4228, top=0x7fffffffa758 "f8\366\367\377\177", activation=0x7fffffffa800) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonFrames.cpp:562
#7  0x0000000000807df6 in js::ion::MarkIonActivations (rt=0x7ffff7fb4010, trc=0x7ffff7fb4228) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonFrames.cpp:581
(More stack frames follow...)
(gdb) x /i $pc
=> 0x40556e <js::gc::Cell::compartment() const+24>:     mov    (%rax),%rax
(gdb) info reg rax
rax            0xfff8800000000000       -2111062325329920