GenerationalGC: Crash [@ GetGCThingRuntime] or Assertion failure: (ptrBits & 0x7) == 0, at dist/include/js/Value.h

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
5 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
x86_64
Linux
assertion, crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 791559 [details]
stack

function g() {
    return function(code) {
            eval(code)
    }
}
g()
function f(code) {
    eval(code)
}
f("\
    a1 = [];\
    Object.defineProperty(a1, 3, {\
        get: (function() {\
            Uint8Array(a1)\
        })\
    });\
    function f2() {\
        for (let mgmmvd = 0; mgmmvd < 21; ++mgmmvd) {\
            for (d in [objectEmulatingUndefined(),\
                new Boolean(false),\
                Boolean,\
                new Boolean(false),\
                objectEmulatingUndefined,\
                new Boolean(false),\
                objectEmulatingUndefined,\
                new Boolean(false),\
                new Boolean(),\
                new Boolean,\
                new Boolean(false),\
                new Boolean,\
                objectEmulatingUndefined(),\
                objectEmulatingUndefined(),\
                objectEmulatingUndefined()\
            ]) {}\
        }\
    }\
    Object.defineProperty(a1, 1, {\
        get: (function() {\
            for (j = 0; j < 72; ++j) {\
                f2()\
            }\
        })\
    });\
    Array.prototype.pop.call(a1)\
")
([{
    fun: function(d, b) {}
},
{},
{
    fun: function(d, b) {}
}, {
    fun: function(d, b) {}
}, {
    fun: function(d, b) {}
}, ]);

asserts js debug threadsafe shell (64-bit) on m-i changeset a63f47fcbe98 without any CLI arguments at Assertion failure: (ptrBits & 0x7) == 0, at dist/include/js/Value.h

Variants crash at GetGCThingRuntime instead (which I'll comment shortly).
Flags: needinfo?(terrence)
(Reporter)

Comment 1

5 years ago
Created attachment 791562 [details]
stack for crash

x = [];
Object.defineProperty(x, 3, {
    get: (function() {
        Uint8Array(x)
    })
});
Object.defineProperty(x, 1, {
    get: (function() {
        for (j = 0; j < 72; ++j) {
            for (let z = 0; z < 21; ++z) {
                for (d in [
                    objectEmulatingUndefined(),
                    new Boolean(false),
                    Boolean,
                    new Boolean(false),
                    objectEmulatingUndefined,
                    new Boolean(false),
                    objectEmulatingUndefined,
                    new Boolean(false),
                    new Boolean(),
                    new Boolean,
                    new Boolean(false),
                    new Boolean,
                    objectEmulatingUndefined(),
                    objectEmulatingUndefined(),
                    objectEmulatingUndefined()
                ]) {}
            }
        }
    })
});
Array.prototype.pop.call(x)

Crash [@ GetGCThingRuntime]
(Reporter)

Updated

5 years ago
Crash Signature: [@ GetGCThingRuntime]
I can reproduce this at the original changeset, but not at the current tip (28c308fbc854) so this must have been fixed by something in the meantime.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: needinfo?(terrence)
Resolution: --- → WORKSFORME
Gary, could you bisect the fix to see what the problem was?
Flags: needinfo?(gary)
(Reporter)

Comment 4

5 years ago
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/32e6af3f6a05
user:        Andy Wingo
date:        Fri Aug 23 11:07:10 2013 -0400
summary:     Bug 904701 - Implement prototype madness for ES6 generators. r=bhackett, r=jorendorff

Both testcases seemed to be fixed by bug 904701. Terrence, I suppose this makes sense?
Flags: needinfo?(terrence)
Flags: needinfo?(gary)
Flags: in-testsuite?

Comment 5

5 years ago
I don't get it, myself, as there is nothing generators-related in that test case.
Andy, did this maybe affect for-in loops somehow?
Flags: needinfo?(terrence)
(Reporter)

Updated

5 years ago
Flags: needinfo?(wingo)

Comment 7

5 years ago
Maybe, I guess checking how to get an iterator from a value -- but I thought that was fixed by https://bugzilla.mozilla.org/show_bug.cgi?id=908920.  Does this bug reproduce after the patch from that bug is applied?
Flags: needinfo?(wingo)

Comment 8

5 years ago
I see from comment 2 that the bug does not reproduce in tip.  I think it's likely that the bug was introduced by my patch in bug 904701 and fixed by bug 908920.
You need to log in before you can comment on or make changes to this bug.