817444 - IonMonkey: Assertion failure: isAtom(), at ../../vm/String.h:380

Status: RESOLVED DUPLICATE of bug 820186

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 2533bce8e045 (run with --ion-eager):


var lfcode = new Array();
lfcode.push("4");
lfcode.push("");
lfcode.push("0");
lfcode.push("reportCompare();");
lfcode.push("\
gczeal(10,2)\n\
function testScatterConflict() {\n\
  var p = new ParallelArray([1,2,3,4,5]);\n\
}\n\
testScatterConflict();\n\
");
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
        if (file == "evaluate") {
        } else {
                loadFile(file);
        }
}
function loadFile(lfVarx) {
        try {
                if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
                        switch (lfRunTypeId) {
                                case 0: evaluate(lfVarx); break;
                                case 4: print(lfVarx); evaluate(lfVarx,{ newContext: true, compileAndGo: true, global: newGlobal('new-compartment') }); break;
                        }
                } else if (!isNaN(lfVarx)) {
                        lfRunTypeId = parseInt(lfVarx);
                }
        } catch (lfVare) {}
}

Comment 1

[Christian Holler (:decoder)]

Marking s-s because the test is not stable and involves GC, likely a memory corruption.

Comment 2

[Shu-yu Guo [:shu]]

Looks like a crash in TI.

If you replace the |ParallelArray| line with another constructor, like |TypedArray|, the testcase still crashes. Absolving myself of trying to debug this; not enough spare cycles at the moment.

CCing bhackett also.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   114220:f55177f70719
user:        Jon Coppeard
date:        Fri Nov 16 15:34:22 2012 +0000
summary:     Bug 790338 - Sweep compartments in groups r=billm

This iteration took 0.300 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Ccing jcoppeard by comment 3.

Comment 5

[Christian Holler (:decoder)]

Jon, can you take a look and propose a security rating for the bug? It could also be a duplicate to bug 820349 or bug 820215 since it contains gczeal(10).

Comment 6

[Shu-yu Guo [:shu]]

Attachment: Stack trace

Brief discussion with bhackett on IRC:

< bhackett> shu: it looks like the TypeObject's propid got swept out from under it

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

That sounds similar to bug 820186.

Comment 8

[Jon Coppeard (:jonco)]

This is the same issue as bug 820186 - marking as duplicate.