900405 - GenerationalGC: Assertion failure: nslots > 2, at gc/Nursery.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    [{ "9": [] }.watch([], function(){})]
})()

crashes js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset 95870d5337eb without any CLI arguments at Assertion failure: nslots > 2, at gc/Nursery.cpp when the shell is compiled with --enable-gcgenerational --enable-exact-rooting.

Comment 1

[Terrence Cole [:terrence]]

Attachment: fuzz_900405-v0.diff

The assertion that is firing here is simply incorrect. It should be >= instead of >. Additionally, I noticed when debugging that NULL slots are getting inserting into the external slots/elements set, causing us to free(NULL) -- for no effect -- during minor GC. I threw that fix in here since it is also trivial.

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/69c38726a5ad

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/69c38726a5ad