981462 - GenerationalGC: Crash [@ js::ObjectImpl::compartment] or Opt-Crash [@ js::ArrayBufferObject::sweep]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision d01bf8596d3b (run with --fuzzing-safe):


gcPreserveCode();
function reportCompare (expected, actual, description) {
  "', Actual value '" + toPrinted(actual) + "' ";
  if (typeof document != "object" ||  !document.location.href.match(/jsreftest.html/)) {}
}
gczeal(9, 1)
try {
  var StructType = TypedObject.StructType;
  var uint8 = TypedObject.uint8;
  function assertEqColor(c1, c2) assertEq(c1.b, c2.b);
  var RgbColor = new StructType({r: uint8, g: uint8, b: uint8});
  var Fade = new StructType({from: RgbColor, to: RgbColor});
  var white = new RgbColor({r: 255, g: 255, b: 255});
  var fade = new Fade({from: white, to: white});
  assertEqColor(white, fade.from);
  assertEqColor(white, fade.to);
  reportCompare(true, true);
} catch(exc1) {}

Comment 1

[Jon Coppeard (:jonco)]

Reproduced in debug build with the following simplified test case:

gcPreserveCode();
var StructType = TypedObject.StructType;
var uint8 = TypedObject.uint8;
function assertEqColor(c1, c2) assertEq(c1.b, c2.b);
var RgbColor = new StructType({r: uint8, g: uint8, b: uint8});
var Fade = new StructType({from: RgbColor, to: RgbColor});
var white = new RgbColor({r: 255, g: 255, b: 255});
gczeal(9, 1);
var fade = new Fade({from: white, to: white});
assertEqColor(white, fade.from);
assertEqColor(white, fade.to);

Comment 2

[Jon Coppeard (:jonco)]

Looks like this was introduced by the fix for bug 978387.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug981462-liveArrayBufferLists

The fix is to save and restore the live array buffer list over minor GC if we are in the middle of an incremental collection.

This unfortunately adds another unhandlable OOM situation though.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 082761b7bc54).

Comment 6

[Terrence Cole [:terrence]]

Comment on attachment 8393012 [details] [diff] [review]
bug981462-liveArrayBufferLists

Review of attachment 8393012 [details] [diff] [review]:
-----------------------------------------------------------------

Great find! r=me

Comment 7

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3891b9d0b1e3

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3891b9d0b1e3

Comment 10

[u279076]

(In reply to Christian Holler (:decoder) from comment #4)
> JSBugMon: The testcase found in this bug no longer reproduces (tried
> revision 082761b7bc54).

Changing testcase to testcase-wanted as per this comment.

Comment 11

[u279076]

Assuming verified fixed based on 0 reports of this signature in the last week on crash-stats.