981452 - GenerationalGC: Crash [@ js::DenseRangeRef::mark] with Float64Array

Status: RESOLVED DUPLICATE of bug 979480

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision d01bf8596d3b (run with --fuzzing-safe --ion-compile-try-catch --ion-eager).

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Jon Coppeard (:jonco)]

I can't reproduce this after the fix for bug 978353 at changeset 9f10d2111536 (I noticed that the testcase includes file c097a72979be65c8a47f39d64af18d54f4606496.js which is very similar to the testcase for bug 978353).

Is the changeset in comment 0 correct or does this need something else to make it reproduce?

Comment 3

[Christian Holler (:decoder)]

I confirmed that the test reproduces with the changeset in comment 0, which should be after the fix for bug 978353, right? 

The build is a 32 bit debug+opt ggc build:

CC='gcc -m32' CXX='g++ -m32' AR=ar ../configure --enable-debug --enable-optimize --disable-threadsafe --enable-valgrind --target=i686-pc-linux-gnu --enable-exact-rooting --enable-gcgenerational

Comment 4

[Jon Coppeard (:jonco)]

Thanks, I reproduced this with the configure options and changeset given.  The problem seems to be that array buffer object's element pointer is being overwritten with a floating point NaN value.

This doesn't reproduce on the current tip however.  I bisected and found that this stopped happening at:

changeset:   173611:b80f97b00d2f
user:        Brian Hackett <[e-mail]>
date:        Fri Mar 14 12:18:14 2014 -0600
summary:     Bug 979480 - Don't store array buffer contents in elements, r=sfink.

That patch substantially changed the implementation of array buffers, so I'm going to close this as a duplicate.