If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: addr % Cell::CellSize == 0, at ../../gc/Heap.h:825 or Crash [@ js::gc::ArenaHeader::allocated]

RESOLVED DUPLICATE of bug 767074

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 767074
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, sec-high, testcase})

Trunk
x86
Linux
assertion, sec-high, testcase
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed, crash signature)

(Reporter)

Description

5 years ago
The following test asserts/crashes on mozilla-central revision b39f4007be5a (options -m -n -a):


var callStack = new Array();
function exitFunc (funcName) {
  var lastFunc = callStack.pop();
}
var appendToActual = function(s) {
    actual += s + ',';
}
Function.prototype.toString = function () f("h" ,1, exitFunc ('test'));
gczeal(4);
actual = '';
function f() {
  var a = arguments;
  appendToActual(a.callee);
}
f({}, 'a');


Debug build crashes when stepping over assertions:


==56976== Invalid read of size 1
==56976==    at 0x804C8F3: js::gc::ArenaHeader::allocated() const (Heap.h:467)
==56976==    by 0x804C970: js::gc::ArenaHeader::getAllocKind() const (Heap.h:497)
==56976==    by 0x806BD7A: js::gc::Cell::getAllocKind() const (Heap.h:935)
==56976==    by 0x80FF19E: js::gc::GetGCThingTraceKind(void const*) (jsgcinlines.h:30)
==56976==    by 0x836784F: js::gc::MarkKind(JSTracer*, void**, JSGCTraceKind) (Marking.cpp:256)
==56976==    by 0x8367E99: js::gc::MarkValueInternal(JSTracer*, JS::Value*) (Marking.cpp:362)
==56976==    by 0x8367FE0: js::gc::MarkValueRoot(JSTracer*, JS::Value*, char const*) (Marking.cpp:384)
==56976==    by 0x82EB525: js::StackSpace::markFrameValues(JSTracer*, js::StackFrame*, JS::Value*, unsigned char*) (Stack.cpp:622)
==56976==    by 0x82EB764: js::StackSpace::mark(JSTracer*) (Stack.cpp:677)
==56976==    by 0x81150DE: js::MarkRuntime(JSTracer*, bool) (jsgc.cpp:2397)
==56976==    by 0x811A33D: js::gc::StartVerifyBarriers(JSRuntime*) (jsgc.cpp:4498)
==56976==    by 0x811AC0F: js::gc::MaybeVerifyBarriers(JSContext*, bool) (jsgc.cpp:4681)
==56976==  Address 0xc is not stack'd, malloc'd or (recently) free'd

On 64 bit this also asserts as:

Assertion failure: (ptrBits & 0x7) == 0, at js/src/jsval.h:731


S-s because this is a GC-related assertion.
Keywords: sec-high
(Assignee)

Updated

5 years ago
Assignee: general → wmccloskey
(Assignee)

Updated

5 years ago
Group: core-security
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 767074
(Reporter)

Comment 2

5 years ago
A testcase for this bug was already added in the original bug (bug 767074).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.