854807 - Crash [@ js::gc::Cell::tenuredZone] with [@ js::CloneFunctionAtCallsite] on the stack

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    with({
        z: /x/
    });
} catch (e) {}
try {
    function y() {}
} catch (e) {}
try {
    (c <<= x)()
} catch (e) {}
try {} catch (e) {}
try {
    a(function() {})
} catch (e) {}
try {
    e(function() {})
} catch (e) {}
try {} catch (e) {}
try {
    h(function() {})
} catch (e) {}
try {
    (function() {
        function x() {}
    })()
} catch (e) {}
try {
    c.delete = ParallelArray.prototype.scatter
} catch (e) {}
try {
    (function() {
        for (let d in [String()]) {}
    })()
} catch (e) {}
try {
    (function() {
        function z(d = (function() {}))(0)
    })()
} catch (e) {}
try {
    var c, x
} catch (e) {}
try {
    for (let b;;) {
        z
    }
} catch (e) {}
try {
    (function() {
        ArrayBuffer()()
    })()
} catch (e) {}
try {
    (function() {
        for (let a in [0]) {
            a(function() {})
        }
    })()
} catch (e) {}
try {
    let d
} catch (e) {}
try {
    e1.delete()

    function x() {}
} catch (e) {}
try {
    (function() {})()
} catch (e) {}
try {
    (function() {
        2(function() {})
    })()
} catch (e) {}
try {
    (function() {})()
} catch (e) {}
try {
    x |= x
} catch (e) {}
try {
    (function() {
        ("" (function() {}))
    })()
} catch (e) {}
try {
    (function() {})()
} catch (e) {}
try {
    (function() {
        function p() {
            eval()
        }
    })()
} catch (e) {}
try {
    0(function() {})
} catch (e) {}
try {
    (function() {})()
} catch (e) {}
try {
    e1 = x
} catch (e) {}
try {
    gc()
} catch (e) {}
try {
    (function() {
        s()
    })()
} catch (e) {}
try {
    with(verifyprebarriers()) z
} catch (e) {}
try {} catch (e) {}
try {} catch (e) {}
try {
    (function() {
        (g(function() {
            (a(function() {
                if (j) {
                    (a(function() {
                        return function() {
                            (function()'') + ''
                            o = {}
                        }
                    }))
                }
            }))
        }))
    })()
} catch (e) {}
try {} catch (e) {}
try {
    g[""]
} catch (e) {}
try {
    gc()
} catch (e) {}
try {
    gc()
} catch (e) {}
try {
    for (melsky = 0; melsky < 2; e) {
        let y
    }
} catch (e) {}
try {} catch (e) {}
try {
    (function() {
        l
    })()
} catch (e) {}
try {} catch (e) {}
try {
    gc()
} catch (e) {}
try {} catch (e) {}
try {
    [1]
} catch (e) {}
try {
    for (b in ((function() / x / ))) {}
} catch (e) {}
try {
    (h)
} catch (e) {}
try {
    for (e in [(0), , (1)]) {}
} catch (e) {}
try {
    (function() {
        for (let x;;) {
            t(function() {})
        }
    })()
} catch (e) {}
try {} catch (e) {}

crashes js opt shell on m-c changeset 456cb08f8509 with --no-ion -a -d at js::gc::Cell::tenuredZone

Locking s-s because gc seems to be involved.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   126082:683bb0caab3a
user:        Nicholas Nethercote
date:        Sun Mar 24 15:28:38 2013 -0700
summary:     Bug 854212 - Fix link errors in jsfuninlines.h caused by bug 851421.  r=smaug.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt stack

njn, is bug 854212 a probable cause?

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Error: Failed to isolate test from comment

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: same testcase as comment 0

Retrying this so hopefully JSBugMon can pick it up.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 5

[Nicholas Nethercote [inactive]]

Attachment: patch

Oh god, bug 854212 was totally trivial but I managed to botch it anyway.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 729451 [details] [diff] [review]
patch

Uh, sorry.

Comment 7

[Nicholas Nethercote [inactive]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4b4f4b9192d9

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4b4f4b9192d9

Can we land this test please?

Comment 9

[Daniel Veditz [:dveditz]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)
> Can we land this test please?

We can land a test for this, sure.

Comment 10

[Nicholas Nethercote [inactive]]

The test didn't reproduce the problem for me, BTW.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Nicholas Nethercote [:njn] from comment #10)
> The test didn't reproduce the problem for me, BTW.

I could easily reproduce this bug - but the testcases might have been platform-specific or something.

Nonetheless, it probably wouldn't hurt to have one more test in the tree.