788364 - Invalid write of size 8 [@ js::SetIteratorObject::finalize]

Status: VERIFIED DUPLICATE of bug 779025

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Valgrind stack

x = new Set
x.add()
for (v of x) {
  y
}

shows the following error on 64-bit js opt shell on m-c changeset 7c75cd38626a :

==15342== Invalid write of size 8
==15342==    at 0x60C8FB: js::SetIteratorObject::finalize(js::FreeOp*, JSObject*) (MapObject.cpp:295)
==15342==    by 0x47C5B9: bool js::gc::Arena::finalize<JSObject>(js::FreeOp*, js::gc::AllocKind, unsigned long) (jsobjinlines.h:235)
==15342==    by 0x4803E5: js::gc::FinalizeArenas(js::FreeOp*, js::gc::ArenaHeader**, js::gc::ArenaList&, js::gc::AllocKind, js::SliceBudget&) [clone .constprop.342] (jsgc.cpp:412)
==15342==    by 0x482E16: IncrementalCollectSlice(JSRuntime*, long, js::gcreason::Reason, js::JSGCInvocationKind) (jsgc.cpp:1626)
==15342==    by 0x483BCC: GCCycle(JSRuntime*, bool, long, js::JSGCInvocationKind, js::gcreason::Reason) (jsgc.cpp:4392)
==15342==    by 0x484007: Collect(JSRuntime*, bool, long, js::JSGCInvocationKind, js::gcreason::Reason) [clone .part.316] (jsgc.cpp:4500)
==15342==    by 0x4449C3: js::DestroyContext(JSContext*, js::DestroyContextMode) (jscntxt.cpp:436)
==15342==    by 0x4097E4: DestroyContext(JSContext*, bool) (js.cpp:4594)
==15342==    by 0x4042BD: main (js.cpp:4957)

using the following command on Ubuntu Linux 12.04 with Valgrind SVN build r12957:

valgrind ./js testcase.js

s-s because this is an invalid write.

Comment 1

[Christian Holler (:decoder)]

Could be related to bug 779025 but I guess jorendorff is the best person to ask here :)

Comment 2

[Andrew McCreight [:mccr8]]

Iterable sets initially landed in bug 725909. I'm just going to mark this sg-crit, as it seems sketchy.  Feel free to downgrade as appropriate.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   100489:76fba3ad58dd
user:        Jason Orendorff
date:        Wed Jul 04 10:24:25 2012 -0500
summary:     Bug 725909 - Make Maps and Sets iterable. r=luke.

Comment 4

[Jason Orendorff [:jorendorff]]

Gary, can you confirm that rev 278080ef7545 fixed this?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I verify that the error shows up in the parent of rev 278080ef7545 , which is 3091da11f7ab, but not in 278080ef7545 itself.

-> VERIFIED

Comment 6

[Christian Holler (:decoder)]

This is already covered by a jit-test, in-testsuite-.