Closed Bug 975961 Opened 6 years ago Closed 6 years ago

GenerationalGC: Crash [@ PushMarkStack] or [@ js::gc::Cell::arenaHeader]

Categories

(Core :: JavaScript: GC, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 975959

People

(Reporter: gkw, Assigned: terrence)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [jsbugmon:update,bisect])

Crash Data

Attachments

(1 file)

Attached file stacks
try {
    verifyprebarriers()
    Array.buildPar(4, function() {})
    Array.buildPar(2, function() {})
} catch (e) {}
gcPreserveCode()
gcslice(1)
Array.buildPar(3, function() {})

crashes js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset 1238ef12b996 with --fuzzing-safe --ion-parallel-compile=off --ion-eager at js::gc::Cell::arenaHeader and crashes js opt shell at PushMarkStack

My configure options are: (opt shell)

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>

Debug shell:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
Assignee: nobody → terrence
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
Whiteboard: [jsbugmon:update,bisect]
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 975959
You need to log in before you can comment on or make changes to this bug.