756851 - "Assertion failure: hasAllFlags(OBJECT_FLAG_DYNAMIC_MASK),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

o0 = {};
g = new ArrayBuffer;
g2 = this;
v = g2.o0.t;
o0 = Object;
print(
    {
        x: gc(gcPreserveCode())
    }
);
for (z = 0; z < 3; z) {}

asserts js debug shell on m-c changeset 642d1a36702f with -m and -n at Assertion failure: hasAllFlags(OBJECT_FLAG_DYNAMIC_MASK),

Tested on 64-bit.

gcPreserveCode seems to be involved but I have no idea how serious this might be, setting s-s to be safe.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   94390:5232403e7b8f
user:        Till Schneidereit
date:        Fri May 18 13:35:43 2012 -0400
summary:     Bug 755604 - Incrementalize JSCompartment::markTypes. r=billm

Comment 1

[Till Schneidereit [:till]]

Attachment: fix

The attached patch fixes the assert.

The problem was a missing call to object->markIfUnmarked before GCMarker::pushObject.

I wonder if maybe pushObject and friends should assert that their targets have been marked to prevent similar issues in the future?

Comment 2

[Till Schneidereit [:till]]

Pushed to try: https://tbpl.mozilla.org/?tree=Try&rev=786e061ae7f3

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 625500 [details] [diff] [review]
fix

Oops, sorry. I should have caught this.

Comment 4

[Till Schneidereit [:till]]

Thanks Bill!

Comment 5

[Andrew McCreight [:mccr8]]

Pushed to m-c.

https://hg.mozilla.org/mozilla-central/rev/fb3036d9b9e6

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Possible to write a test for this?

Comment 7

[Till Schneidereit [:till]]

I guess I can massage the fuzzer result into a somewhat sane test. Will ask on #jsapi for details.

Comment 8

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 9

[Robert Kaiser]

I guess this can be opened now as it only affected trunk and is verified and in today's Nightly, right?

Comment 12

[Daniel Veditz [:dveditz]]

The crash stacks in bug 756796 look sec-critical

Comment 14

[Christian Holler (:decoder)]

Test added:

https://hg.mozilla.org/integration/mozilla-inbound/rev/7d147fc0477f

Comment 15

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7d147fc0477f