GenerationalGC: Crash [@ lookupGeneric]

RESOLVED FIXED in mozilla26

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: terrence)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla26
x86_64
Linux
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 791576 [details]
stack

for (let y in []);
(function f(x) {
    Float64Array(ArrayBuffer());
    {
        f(x)
        function t() {}
    }
})();

crashes js debug shell (tested with a threadsafe 64-bit debug build) on m-i changeset a63f47fcbe98 without any CLI arguments at lookupGeneric

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   140539:1a0e01422cb3
user:        Terrence Cole
date:        Wed Jul 10 10:13:46 2013 -0700
summary:     Bug 889682 - Eagerly check for remembered set membership before buffering; r=billm
Flags: needinfo?(terrence)
(Assignee)

Comment 1

5 years ago
Created attachment 792317 [details] [diff] [review]
fuzz_906241-v0.diff

Great find, Gary! This is a dup of bug 906128, but I'm going to use this bug because of the nice test case.
Assignee: general → terrence
Status: NEW → ASSIGNED
Attachment #792317 - Flags: review?(bhackett1024)
Flags: needinfo?(terrence)
(Assignee)

Updated

5 years ago
Duplicate of this bug: 906128
Comment on attachment 792317 [details] [diff] [review]
fuzz_906241-v0.diff

Review of attachment 792317 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/VMFunctions.cpp
@@ +459,5 @@
> +    JSObject *obj = CallObject::create(cx, script, shape, type, slots);
> +
> +    // The JIT creates call objects in the nursery, so elides barriers for
> +    // the initializing writes. The interpreter, however, may have allocated
> +    // the call object tenured, so barrier as needed before re-entering.

This comment is kind of confusing, as it's not a question of the interpreter's behavior here but that of the VM call.  How about s/The JIT/Inline code/ and s/The interpreter/VM calls/
Attachment #792317 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 7

5 years ago
I did not qref before cherrypicking, so the test was missing its expected error header.

Relanded:

https://hg.mozilla.org/integration/mozilla-inbound/rev/ec62e23bf94b
https://hg.mozilla.org/mozilla-central/rev/ec62e23bf94b
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in before you can comment on or make changes to this bug.