889290 - Assertion failure: isObject(), at js/Value.h:1068 or Crash [@ TraceArrayBufferView]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 4ffb23062b3b (run with --fuzzing-safe --ion-eager):


gczeal(2,4);
function asmModule(heap) {
    var g = newGlobal('new-compartment');
    new g.Int8Array(heap);
}
asmModule(new ArrayBuffer(2048));

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Not sure if this is actually s-s. Is it possible to get an Int8Array constructor from a different global without the newGlobal function?

Comment 3

[Luke Wagner [:luke]]

The assert reproduces with --no-ion --no-baseline --no-asmjs.  I'd expect that this is a typed array GC bug.

Comment 4

[Luke Wagner [:luke]]

Random note decoder/gary: it might be useful to have a gczeal() mode that triggers all the time, but only after the self-hosted code has finished loading; I think that is what makes this testcase take so long.

Comment 5

[Andrew McCreight [:mccr8]]

Marking high because it sounds like a GC bug.  Adjust the rating as needed.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/866dbb8830d1
user:        Terrence Cole
date:        Mon Jun 24 17:33:27 2013 -0700
summary:     Bug 886575 - Update TypedArray's data slot when doing fallback marking for minor GC; r=sfink

This iteration took 325.986 seconds to run.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision f2d3b5149d3a).

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I suspect this was fixed by bug 891773, but let's recheck.

Comment 9

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3433a021847b).

Comment 10

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9a908856c46c
user:        Terrence Cole
date:        Thu Jul 11 14:34:54 2013 -0700
summary:     Bug 891773 - Check ArrayBufferView's back reference before marking; r=sfink

This iteration took 345.087 seconds to run.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yup, fixed by bug 891773.

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.