Closed Bug 861439 Opened 9 years ago Closed 9 years ago

Crash [@ js::UncheckedUnwrap] with bug 804676 fixes

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(Keywords: crash, regression, testcase)

Attachments

(2 files)

Attached file stacks
try {
    x = evalcx('')
    toSource = (function() {
        x = (new WeakMap).get(function() {})
    })
    valueOf = (function() {
        schedulegc(x)
    })
    this + ''
    for (v of this) {}
} catch (e) {}
gc()
this + 1

crashes js debug and opt shell on ionmonkey (where bug 804676 fixes landed for testing) changeset 79f78c194329 with --ion-eager and --no-baseline at js::UncheckedUnwrap
Flags: needinfo?(bhackett1024)
I can't reproduce this.
Flags: needinfo?(bhackett1024)
(In reply to Brian Hackett (:bhackett) from comment #1)
> I can't reproduce this.

I can definitely reproduce with --enable-more-deterministic. 

sh ./configure --target=x86_64-apple-darwin11.4.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
TypeObject property information doesn't reflect the initial undefined values for properties of singleton objects.  (This quirk allows better handling for global variables declared with 'var', which will have an undefined value before getting their real value.)  This wasn't being accounted for right when Ion was adding type barriers on property reads; this patch fixes that and commons the related logic a bit.

https://hg.mozilla.org/projects/ionmonkey/rev/75ff34ead9fc
Assignee: general → bhackett1024
Attachment #737431 - Flags: review?(dvander)
Flags: needinfo?(bhackett1024)
Attachment #737431 - Flags: review?(dvander) → review+
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.