975961 - GenerationalGC: Crash [@ PushMarkStack] or [@ js::gc::Cell::arenaHeader]

Status: RESOLVED DUPLICATE of bug 975959

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

try {
    verifyprebarriers()
    Array.buildPar(4, function() {})
    Array.buildPar(2, function() {})
} catch (e) {}
gcPreserveCode()
gcslice(1)
Array.buildPar(3, function() {})

crashes js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset 1238ef12b996 with --fuzzing-safe --ion-parallel-compile=off --ion-eager at js::gc::Cell::arenaHeader and crashes js opt shell at PushMarkStack

My configure options are: (opt shell)

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>

Debug shell:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>