As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact bugzilla-admin@mozilla.org
Last Comment Bug 780027 - Crash [@ js::gc::MarkInternal<JSString>] or [@ js::gc::MarkIdRootRange] or "Assertion failure: thing,"
: Crash [@ js::gc::MarkInternal<JSString>] or [@ js::gc::MarkIdRootRange] or "A...
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla17
Assigned To: Bill McCloskey (:billm)
: general
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 779393
  Show dependency treegraph
 
Reported: 2012-08-02 16:19 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-08-09 19:57 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stacks (19.02 KB, text/plain)
2012-08-02 16:19 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
not the smallest regression window (52.97 KB, text/plain)
2012-08-02 16:25 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
patch (620 bytes, patch)
2012-08-07 17:33 PDT, Bill McCloskey (:billm)
terrence.d.cole: review+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:19:34 PDT
Created attachment 648543 [details]
stacks

x = y = [0,,0]
print(uneval)
for (z = 0; z < 89; ++z) {
    x = x.concat(y)
}
schedulegc(8)
uneval(x)

asserts js debug shell on m-i changeset 1924fe55fb6e without any CLI arguments at Assertion failure: thing, and crashes js opt shell at js::gc::MarkInternal<JSString> with js::gc::MarkIdRootRange somewhere on the stack.
Comment 1 User image Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:20:39 PDT
autoBisect is running, but incremental GC stuff seem to be on the stack, cc'ing iGC folks.
Comment 2 User image Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:25:28 PDT
Created attachment 648546 [details]
not the smallest regression window
Comment 3 User image Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:31:17 PDT
I won't have the regressing bug pointed at by autoBisect because in the range in comment 2, some changesets don't compile, so it's about the best one can have for the moment.
Comment 4 User image Bill McCloskey (:billm) 2012-08-07 17:33:59 PDT
Created attachment 649894 [details] [diff] [review]
patch

We're asserting because we try to mark a NULL jsid. That happens because we aren't properly initializing an AutoIdVector after reserving space out of it.
Comment 5 User image Bill McCloskey (:billm) 2012-08-07 17:34:27 PDT
Not sensitive because it only affects JS_MORE_DETERMINISTIC builds.
Comment 6 User image Gary Kwong [:gkw] [:nth10sd] 2012-08-07 17:37:55 PDT
This is likely fallout from bug 779393 which in turn likely was fallout from bug 776579.
Comment 8 User image Ryan VanderMeulen [:RyanVM] 2012-08-09 19:57:30 PDT
https://hg.mozilla.org/mozilla-central/rev/475b2318e182

Note You need to log in before you can comment on or make changes to this bug.