876495 - Crash [@ js::gc::Cell::tenuredZone] or Opt-Crash [@ js::ObjectImpl::markChildren] with countHeap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision a39263b0c896 (run with --ion-eager):


var o0 = [];
var o4 = {};
function f6(o) { 
  o[3] = o;
};
for(var i=0; i<20; i++) {
    f6(o0);
    f6(o4);
}
countHeap();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132964:3835cbed5915
user:        Nicolas B. Pierron
date:        Fri May 24 14:58:08 2013 -0700
summary:     Bug 774006 - IonMonkey: Implement SetElementIC for integer indexes. r=h4writer

This iteration took 317.915 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from Nicolas based on comment 2 :)

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 495b385ae811).

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 495b385ae811).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   133116:00b0dc4c196e
user:        Hannes Verschore
date:        Tue May 28 15:09:25 2013 +0200
summary:     Bug 876649: IonMonkey: Temporary disable MSetElementCache when no dense write is seen, r=jandem

This iteration took 296.761 seconds to run.

Comment 6

[Nicolas B. Pierron [:nbp]]

We should land these test cases, as they highlight cases which are failling with the additional patch of Hannes, and as we want to remove/weaken the condition added by Hannes having these tests in the tree would help prevent them to re-appear.

This case means that the case I thought I handled correctly to check for out-of-bounds uses are not working in the current IC.

Comment 8

[derzkii_steam]

[Tracking Requested - why for this release]:

Comment 9

[Nicolas B. Pierron [:nbp]]

(In reply to Nicolas B. Pierron [:nbp] {backlog: ~41} from comment #6)
> We should land these test cases

We can no longer land the test case because countHeap got removed (Bug 1169097)