831658 - "Assertion failure: inUse_.empty(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

String.prototype.search = evalcx('').String.prototype.search
x = /./.test()
''.search(/()/)

asserts js debug shell on m-c changeset ce9cdd801a73 without any CLI arguments at Assertion failure: inUse_.empty(),

s-s because gc is on the stack.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   118977:f2e3d3913d70
user:        Sean Stangl
date:        Tue Jan 15 15:35:25 2013 -0800
summary:     Bug 829758 - use MatchOnly mode for str_search(). r=dvander

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sean, this seems to point to bug 829758 as the regressor.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tentatively rating sec-critical, because compartments and gc are on the stack.

Comment 3

[Sean Stangl [:sstangl]]

Attachment: fix

evalcx() lets multiple RegExpStatics leak into the same RegExpCompartment's RegExpShared usage table. This is safe: we just need to iterate in the destructor.

Comment 4

[Sean Stangl [:sstangl]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4e7658d7727c

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 02e12a80aef9).

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This landed.

http://hg.mozilla.org/mozilla-central/rev/4e7658d7727c

Comment 7

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.