Last Comment Bug 780027 - Crash [@ js::gc::MarkInternal<JSString>] or [@ js::gc::MarkIdRootRange] or "Assertion failure: thing,"
: Crash [@ js::gc::MarkInternal<JSString>] or [@ js::gc::MarkIdRootRange] or "A...
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla17
Assigned To: [PTO to Dec5] Bill McCloskey (:billm)
: general
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 779393
  Show dependency treegraph
 
Reported: 2012-08-02 16:19 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-08-09 19:57 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stacks (19.02 KB, text/plain)
2012-08-02 16:19 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
not the smallest regression window (52.97 KB, text/plain)
2012-08-02 16:25 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
patch (620 bytes, patch)
2012-08-07 17:33 PDT, [PTO to Dec5] Bill McCloskey (:billm)
terrence.d.cole: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:19:34 PDT
Created attachment 648543 [details]
stacks

x = y = [0,,0]
print(uneval)
for (z = 0; z < 89; ++z) {
    x = x.concat(y)
}
schedulegc(8)
uneval(x)

asserts js debug shell on m-i changeset 1924fe55fb6e without any CLI arguments at Assertion failure: thing, and crashes js opt shell at js::gc::MarkInternal<JSString> with js::gc::MarkIdRootRange somewhere on the stack.
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:20:39 PDT
autoBisect is running, but incremental GC stuff seem to be on the stack, cc'ing iGC folks.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:25:28 PDT
Created attachment 648546 [details]
not the smallest regression window
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-08-02 16:31:17 PDT
I won't have the regressing bug pointed at by autoBisect because in the range in comment 2, some changesets don't compile, so it's about the best one can have for the moment.
Comment 4 [PTO to Dec5] Bill McCloskey (:billm) 2012-08-07 17:33:59 PDT
Created attachment 649894 [details] [diff] [review]
patch

We're asserting because we try to mark a NULL jsid. That happens because we aren't properly initializing an AutoIdVector after reserving space out of it.
Comment 5 [PTO to Dec5] Bill McCloskey (:billm) 2012-08-07 17:34:27 PDT
Not sensitive because it only affects JS_MORE_DETERMINISTIC builds.
Comment 6 Gary Kwong [:gkw] [:nth10sd] 2012-08-07 17:37:55 PDT
This is likely fallout from bug 779393 which in turn likely was fallout from bug 776579.
Comment 7 [PTO to Dec5] Bill McCloskey (:billm) 2012-08-09 11:43:45 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/475b2318e182
Comment 8 Ryan VanderMeulen [:RyanVM] 2012-08-09 19:57:30 PDT
https://hg.mozilla.org/mozilla-central/rev/475b2318e182

Note You need to log in before you can comment on or make changes to this bug.