777776 - Invalid read of size 1 or invalid write of size 1 [@ JSScript::markChildren]

Status: VERIFIED FIXED

Description

[Gary Kwong [:gkw] [:nth10sd]]

Created attachment 646190 [details]
Valgrind stack

gczeal(9, 2)
for (a = 0; a < 4; ++a) {
    b =
    evaluate("/x/g");
}

causes an invalid read of size 1 and invalid write of size 1 error on js opt shell on m-c changeset 7065b767f30d with -n using Valgrind, turning s-s because of this.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99950:e080642175e6
user:        Benjamin Peterson
date:        Fri Jul 20 20:17:38 2012 +0200
summary:     Bug 761723 - Save script sources to implement Function.prototype.toString. r=jorendorff,njn,jimb,jst,Ms2ger

During reduction, this testcase has also been known to crash with malloc errors.

Comment 2

[:Benjamin Peterson]

I can't reproduce on Linux 64-bit.

Also, what does "crash with malloc errors" mean?

Comment 3

[Gary Kwong [:gkw] [:nth10sd]]

(In reply to Benjamin Peterson from comment #2)
> I can't reproduce on Linux 64-bit.
> 
> Also, what does "crash with malloc errors" mean?

My opt shell is compiled with --enable-gczeal, --enable-profiling, --enable-debug-symbols, --enable-more-deterministic and --enable-valgrind among others - could you pls retry?

Mac OS X has a special abort mode for binaries in which it says that there was a malloc error, unfortunately I've lost the exact error message.

A similar error message can be found here: bug 736609 comment 0

Comment 4

[:Benjamin Peterson]

--enable-more-determinism seems to do the trick.

Comment 5

[:Benjamin Peterson]

Created attachment 646634 [details] [diff] [review]
add barrier to JSScript::scriptSource_

Comment 6

[Gary Kwong [:gkw] [:nth10sd]]

This bug throws up a lot of weird duplicate errors.

Comment 7

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b69f5004fde8

Comment 8

[:Benjamin Peterson]

And backedout for bustage: https://hg.mozilla.org/integration/mozilla-inbound/rev/c394a354eef7

Comment 9

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4cdd23569371

Comment 10

[:Benjamin Peterson]

Backed out again: https://hg.mozilla.org/integration/mozilla-inbound/rev/a04448be734a

Comment 11

[Gary Kwong [:gkw] [:nth10sd]]

Try using the Try Server first:

https://wiki.mozilla.org/ReleaseEngineering/TryServer

Comment 12

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b6ac2095d264

Comment 13

[:Benjamin Peterson]

http://hg.mozilla.org/mozilla-central/rev/b6ac2095d264

Comment 14

[Gary Kwong [:gkw] [:nth10sd]]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.