Crash [@ js::gc::MarkInternal<JSString>] or [@ js::gc::MarkIdRootRange] or "Assertion failure: thing,"

RESOLVED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: billm)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla17
x86_64
Mac OS X
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 648543 [details]
stacks

x = y = [0,,0]
print(uneval)
for (z = 0; z < 89; ++z) {
    x = x.concat(y)
}
schedulegc(8)
uneval(x)

asserts js debug shell on m-i changeset 1924fe55fb6e without any CLI arguments at Assertion failure: thing, and crashes js opt shell at js::gc::MarkInternal<JSString> with js::gc::MarkIdRootRange somewhere on the stack.
(Reporter)

Comment 1

5 years ago
autoBisect is running, but incremental GC stuff seem to be on the stack, cc'ing iGC folks.
(Assignee)

Updated

5 years ago
Assignee: general → wmccloskey
(Reporter)

Comment 2

5 years ago
Created attachment 648546 [details]
not the smallest regression window
(Reporter)

Comment 3

5 years ago
I won't have the regressing bug pointed at by autoBisect because in the range in comment 2, some changesets don't compile, so it's about the best one can have for the moment.
(Assignee)

Comment 4

5 years ago
Created attachment 649894 [details] [diff] [review]
patch

We're asserting because we try to mark a NULL jsid. That happens because we aren't properly initializing an AutoIdVector after reserving space out of it.
Attachment #649894 - Flags: review?(terrence)
(Assignee)

Comment 5

5 years ago
Not sensitive because it only affects JS_MORE_DETERMINISTIC builds.
Group: core-security
(Reporter)

Comment 6

5 years ago
This is likely fallout from bug 779393 which in turn likely was fallout from bug 776579.
Blocks: 779393
Attachment #649894 - Flags: review?(terrence) → review+
(Assignee)

Comment 7

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/475b2318e182
https://hg.mozilla.org/mozilla-central/rev/475b2318e182
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
You need to log in before you can comment on or make changes to this bug.