Last Comment Bug 766355 - GC valgrind warnings
: GC valgrind warnings
Status: RESOLVED FIXED
[js:t]
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: mozilla16
Assigned To: [PTO to Dec5] Bill McCloskey (:billm)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on: 768732
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-19 15:32 PDT by :Benjamin Peterson
Modified: 2012-06-26 17:57 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (743 bytes, patch)
2012-06-19 15:39 PDT, [PTO to Dec5] Bill McCloskey (:billm)
terrence.d.cole: review+
Details | Diff | Splinter Review

Description :Benjamin Peterson 2012-06-19 15:32:59 PDT
If I configure --enable-valgrind --disable-debug --disable-optimize and run valgrind with any jit test, I get:

==22179== Conditional jump or move depends on uninitialised value(s)
==22179==    at 0x496A87: js::gc::GetAvailableChunkList(JSCompartment*) (jsgc.cpp:616)
==22179==    by 0x4970F7: PickChunk(JSCompartment*) (jsgc.cpp:788)
==22179==    by 0x49808A: js::gc::ArenaLists::allocateFromArena(JSCompartment*, js::gc::AllocKind) (jsgc.cpp:1443)
==22179==    by 0x498763: js::gc::ArenaLists::refillFreeList(JSContext*, js::gc::AllocKind) (jsgc.cpp:1673)
==22179==    by 0x4BF2FD: js::types::TypeObject* js::gc::NewGCThing<js::types::TypeObject>(JSContext*, js::gc::AllocKind, unsigned long) (jsgcinlines.h:419)
==22179==    by 0x4AFEC6: js::types::TypeCompartment::newTypeObject(JSContext*, JSScript*, JSProtoKey, JSObject*, bool) (jsinfer.cpp:1889)
==22179==    by 0x48DC7D: JSCompartment::getEmptyType(JSContext*) (jsinferinlines.h:1492)
==22179==    by 0x50DE0D: js::NewObjectWithGivenProto(JSContext*, js::Class*, JSObject*, JSObject*, js::gc::AllocKind) (jsobj.cpp:2840)
==22179==    by 0x41D07F: js::NewObjectWithGivenProto(JSContext*, js::Class*, JSObject*, JSObject*) (jsobjinlines.h:1381)
==22179==    by 0x639544: js::GlobalObject::create(JSContext*, js::Class*) (GlobalObject.cpp:247)
==22179==    by 0x424D7A: JS_NewGlobalObject (jsapi.cpp:3298)
==22179==    by 0x424E46: JS_NewCompartmentAndGlobalObject (jsapi.cpp:3331)
==22179== 
==22179== Conditional jump or move depends on uninitialised value(s)
==22179==    at 0x496A87: js::gc::GetAvailableChunkList(JSCompartment*) (jsgc.cpp:616)
==22179==    by 0x496ABD: js::gc::Chunk::addToAvailableList(JSCompartment*) (jsgc.cpp:622)
==22179==    by 0x4971E2: PickChunk(JSCompartment*) (jsgc.cpp:812)
==22179==    by 0x49808A: js::gc::ArenaLists::allocateFromArena(JSCompartment*, js::gc::AllocKind) (jsgc.cpp:1443)
==22179==    by 0x498763: js::gc::ArenaLists::refillFreeList(JSContext*, js::gc::AllocKind) (jsgc.cpp:1673)
==22179==    by 0x4BF2FD: js::types::TypeObject* js::gc::NewGCThing<js::types::TypeObject>(JSContext*, js::gc::AllocKind, unsigned long) (jsgcinlines.h:419)
==22179==    by 0x4AFEC6: js::types::TypeCompartment::newTypeObject(JSContext*, JSScript*, JSProtoKey, JSObject*, bool) (jsinfer.cpp:1889)
==22179==    by 0x48DC7D: JSCompartment::getEmptyType(JSContext*) (jsinferinlines.h:1492)
==22179==    by 0x50DE0D: js::NewObjectWithGivenProto(JSContext*, js::Class*, JSObject*, JSObject*, js::gc::AllocKind) (jsobj.cpp:2840)
==22179==    by 0x41D07F: js::NewObjectWithGivenProto(JSContext*, js::Class*, JSObject*, JSObject*) (jsobjinlines.h:1381)
==22179==    by 0x639544: js::GlobalObject::create(JSContext*, js::Class*) (GlobalObject.cpp:247)
==22179==    by 0x424D7A: JS_NewGlobalObject (jsapi.cpp:3298)
Comment 1 :Benjamin Peterson 2012-06-19 15:35:30 PDT
I wrote "--disable-debug" instead of "--enable-debug". That makes no difference.
Comment 2 [PTO to Dec5] Bill McCloskey (:billm) 2012-06-19 15:39:03 PDT
Created attachment 634626 [details] [diff] [review]
patch

I think this only affects the shell. Normally we call JS_SetCompartmentPrincipals, which sets this.
Comment 3 :Benjamin Peterson 2012-06-19 15:52:25 PDT
This fixes it.
Comment 4 [PTO to Dec5] Bill McCloskey (:billm) 2012-06-22 11:32:28 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/bd1992ab029b
Comment 5 Ryan VanderMeulen [:RyanVM] 2012-06-23 05:46:21 PDT
https://hg.mozilla.org/mozilla-central/rev/bd1992ab029b

Note You need to log in before you can comment on or make changes to this bug.