767074 - Assertion failure: (ptrBits & 0x7) == 0, at jsval.h:731 or Crash [@ js::gc::ArenaHeader::allocated]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision c83282305cb9 (options -m -n -a):


var callStack = new Array();
function exitFunc (funcName) {
  var lastFunc = callStack.pop();
}
gczeal(4);
var sb = evalcx('');
sb.parent = this;
this.f = function name(outer) {
        return (exitFunc ('test'));
}
evalcx('this.f = parent.f; var s = ""; for (i = 0; i < 10; ++i) s += f(true); s', sb);


S-s due to assertion known to be dangerous.

Comment 1

[Christian Holler (:decoder)]

This now shows up as

Assertion failure: addr % Cell::CellSize == 0, at ../../gc/Heap.h:825

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

This bug is similar to bug 753283. We run for a while in the methodjit and then we return to the interpreter to finish running the method. We return with the PC set to a SETLOCAL op. We immediately call the barrier verifier, which scans the VM stack. It expects the slot referenced by the SETLOCAL to be valid, but the SETLOCAL hasn't run yet, so it's uninitialized.

The patch just avoids running the verifier at the start of the Interpret when a rejoin is taking place.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/07823fa2edb0

This is a debug-only bug, so no reason to keep it closed.

Comment 6

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/07823fa2edb0

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug767074.js.