783923 - Crash [@ js::ParallelArrayObject::toStringBufferImpl] or "Assertion failure: isObject(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

print(ParallelArray());

asserts js debug shell on m-c changeset 35b8d6ef5d46 without any CLI arguments at Assertion failure: isObject(),

This is blowing up the fuzzers so setting [fuzzblocker].

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   102665:ea2ad8970f3e
user:        Shu-yu Guo
date:        Fri Aug 17 10:38:59 2012 -0700
summary:     Bug 778559 - Implement ParallelArray API with sequential execution (r=dmandelin)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Locking s-s because the possibly-related bug 783924 is s-s. The crash in this bug seems to be a null crash though.

(setting csec-dos because of null crash)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack from opt crash

Comment 3

[Shu-yu Guo [:shu]]

Attachment: fix and testcase

Comment 4

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d194a7d36e65

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d194a7d36e65

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929