885986 - Crash [@ js::EncapsulatedPtr]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

evalcx("\
    function x(y) {\
        schedulegc(1);\
        print(x);\
    };\
    new x\
", newGlobal())

crashes js debug shell on m-c changeset cea75ce9a559 fairly intermittently with --ion-parallel-compile=on at js::EncapsulatedPtr

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f5eca934fa16
user:        Jan de Mooij
date:        Fri Jun 21 08:28:06 2013 +0200
summary:     Bug 881902 - Remove ContextStack and StackSpace. r=luke,njn

Comment 2

[Jan de Mooij [:jandem]]

The follow-up fix I landed for bug 881902 fixes this for me. It has been on inbound for some time now and it should be in the next m-c merge.

Comment 3

[Jan de Mooij [:jandem]]

It would be great if you could confirm comment 2 :)

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Here's another testcase:

x = [];
x[0] = new(function(y) {
    gc()
})();
gc();


I've confirmed that both this testcase and the one in comment 0 do not reproduce with m-i rev f22c958c6187.

The testcases should be landed though.