906241 - GenerationalGC: Crash [@ lookupGeneric]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for (let y in []);
(function f(x) {
    Float64Array(ArrayBuffer());
    {
        f(x)
        function t() {}
    }
})();

crashes js debug shell (tested with a threadsafe 64-bit debug build) on m-i changeset a63f47fcbe98 without any CLI arguments at lookupGeneric

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   140539:1a0e01422cb3
user:        Terrence Cole
date:        Wed Jul 10 10:13:46 2013 -0700
summary:     Bug 889682 - Eagerly check for remembered set membership before buffering; r=billm

Comment 1

[Terrence Cole [:terrence]]

Attachment: fuzz_906241-v0.diff

Great find, Gary! This is a dup of bug 906128, but I'm going to use this bug because of the nice test case.

Comment 3

[Brian Hackett [Laid off!]]

Comment on attachment 792317 [details] [diff] [review]
fuzz_906241-v0.diff

Review of attachment 792317 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/VMFunctions.cpp
@@ +459,5 @@
> +    JSObject *obj = CallObject::create(cx, script, shape, type, slots);
> +
> +    // The JIT creates call objects in the nursery, so elides barriers for
> +    // the initializing writes. The interpreter, however, may have allocated
> +    // the call object tenured, so barrier as needed before re-entering.

This comment is kind of confusing, as it's not a question of the interpreter's behavior here but that of the VM call.  How about s/The JIT/Inline code/ and s/The interpreter/VM calls/

Comment 4

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c4e5ee49fbe

Comment 5

[Terrence Cole [:terrence]]

Backed out for possible bustage in:

https://hg.mozilla.org/integration/mozilla-inbound/rev/5e7bc6009afc

Comment 6

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/5c4e5ee49fbe

Comment 7

[Terrence Cole [:terrence]]

I did not qref before cherrypicking, so the test was missing its expected error header.

Relanded:

https://hg.mozilla.org/integration/mozilla-inbound/rev/ec62e23bf94b

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ec62e23bf94b