902227 - GenerationalGC: Crash [@ tenuredZone]

Status: RESOLVED DUPLICATE of bug 905654

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

ry {
        Object.defineProperty(this, "g1", {
            get: function() {
                newGlobal({
                    sameZoneAs: {}
                })
            }
        })
    g1
    schedulegc(3)()
} catch (e) {}
try {
    for (schedulegc(5);;) {
        g1
    }
} catch (e) {}

crashes js opt shell (tested with a threadsafe deterministic 32-bit opt build) on m-c changeset 3ea0cb5a747e without any CLI arguments at tenuredZone when the shell is compiled with --enable-gcgenerational --enable-exact-rooting.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
        Object.defineProperty(this, "g1", {
            get: function() {
                newGlobal({
                    sameZoneAs: {}
                })
            }
        })
    g1
    schedulegc(3)()
} catch (e) {}
try {
    for (schedulegc(5);;) {
        g1
    }
} catch (e) {}

This is the correct testcase (I was missing a letter at the start).

Comment 2

[Terrence Cole [:terrence]]

Reproduced locally. Will look into it tomorrow.

Comment 3

[Terrence Cole [:terrence]]

Attachment: fuzz_902227-v0.diff

This is a pre-existing, slightly incorrect assertion. |release| wants to assert that the point we are releasing to is <= the top/allocation point. The BumpChunk stores the top pointer unaligned, but the LifoAlloc::Enum stores the traversal position aligned.

The test includes an infinite loop, so I am not attaching it to this patch.

Comment 4

[Terrence Cole [:terrence]]

Gary, I think this must be a different issue than the one you sent me in the mail. This can only be an issue on 32bit and the other issue was reproducing on 64bit as well.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Terrence Cole [:terrence] from comment #4)
> Gary, I think this must be a different issue than the one you sent me in the
> mail. This can only be an issue on 32bit and the other issue was reproducing
> on 64bit as well.

I'm sure I'll find more, hopefully including the one found before.

Comment 6

[Terrence Cole [:terrence]]

Comment on attachment 787247 [details] [diff] [review]
fuzz_902227-v0.diff

Jon found this independently and fixed it in bug 905654.