The following testcase crashes on mozilla-central revision 2c773b971672 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off): loadFile(` gczeal(15,3); foo(); `); function loadFile(lfVarx) oomTest(Function(lfVarx)) Backtrace: received signal SIGSEGV, Segmentation fault. #0 0x0000000000db21f8 in js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup (this=this@entry=0x7fffffffb910, l=@0x7fffffffb598: 0x7ffff0600028, keyHash=<optimized out>, collisionBit=collisionBit@entry=0) at dist/include/js/HashTable.h:1377 #1 0x0000000000daa458 in js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup (l=@0x7fffffffb598: 0x7ffff0600028, this=0x7fffffffb910) at dist/include/js/HashTable.h:1736 #2 js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::lookup (l=@0x7fffffffb598: 0x7ffff0600028, this=0x7fffffffb910) at dist/include/js/HashTable.h:357 #3 CheckHeapTracer::onChild (this=this@entry=0x7fffffffb8c0, thing=...) at js/src/gc/Verifier.cpp:486 #4 0x0000000000dad52c in JS::CallbackTracer::onStringEdge (strp=0x7fffffffb668, this=0x7fffffffb8c0) at dist/include/js/TracingAPI.h:143 #5 JS::CallbackTracer::dispatchToOnEdge (strp=0x7fffffffb668, this=0x7fffffffb8c0) at dist/include/js/TracingAPI.h:225 #6 DoCallback<JSString*> (trc=0x7fffffffb8c0, thingp=thingp@entry=0x7fffffffb668, name=name@entry=0x10821b7 "unit-static-string") at js/src/gc/Tracer.cpp:51 #7 0x0000000000d82800 in js::TraceProcessGlobalRoot<JSAtom> (trc=trc@entry=0x7fffffffb8c8, thing=0x7ffff0600028, name=name@entry=0x10821b7 "unit-static-string") at js/src/gc/Marking.cpp:604 #8 0x0000000000bccc87 in js::StaticStrings::trace (this=0x7ffff698c000, trc=trc@entry=0x7fffffffb8c8) at js/src/vm/String.cpp:861 #9 0x0000000000507d57 in js::MarkPermanentAtoms (trc=trc@entry=0x7fffffffb8c8) at js/src/jsatom.cpp:229 #10 0x0000000000d9e23b in js::gc::GCRuntime::traceRuntimeAtoms (this=this@entry=0x7ffff695f9b0, trc=trc@entry=0x7fffffffb8c8, lock=...) at js/src/gc/RootMarking.cpp:315 #11 0x0000000000d9ee6f in js::gc::GCRuntime::traceRuntime (this=0x7ffff695f9b0, trc=0x7fffffffb8c8, lock=...) at js/src/gc/RootMarking.cpp:307 #12 0x0000000000da0386 in CheckHeapTracer::check (this=this@entry=0x7fffffffb8c0, lock=...) at js/src/gc/Verifier.cpp:521 #13 0x0000000000da4916 in js::gc::CheckHeapAfterGC (rt=<optimized out>) at js/src/gc/Verifier.cpp:550 #14 0x000000000095d995 in js::gc::GCRuntime::minorGC (this=0x7ffff695f9b0, reason=JS::gcreason::DEBUG_GC, phase=<optimized out>) at js/src/jsgc.cpp:6568 #15 0x0000000000999856 in js::gc::GCRuntime::evictNursery (reason=JS::gcreason::DEBUG_GC, this=0x7ffff695f9b0) at js/src/gc/GCRuntime.h:624 #16 js::gc::GCRuntime::gcCycle (this=this@entry=0x7ffff695f9b0, nonincrementalByAPI=nonincrementalByAPI@entry=true, budget=..., reason=reason@entry=JS::gcreason::DEBUG_GC) at js/src/jsgc.cpp:6131 #17 0x000000000099a2bc in js::gc::GCRuntime::collect (this=0x7ffff695f9b0, nonincrementalByAPI=true, budget=..., reason=JS::gcreason::DEBUG_GC) at js/src/jsgc.cpp:6326 #18 0x000000000099b334 in js::gc::GCRuntime::gc (reason=<optimized out>, gckind=<optimized out>, this=<optimized out>) at js/src/jsgc.cpp:6394 #19 js::gc::GCRuntime::runDebugGC (this=this@entry=0x7ffff695f9b0) at js/src/jsgc.cpp:6805 #20 0x0000000000d74158 in js::gc::GCRuntime::gcIfNeededPerAllocation (this=this@entry=0x7ffff695f9b0, cx=cx@entry=0x7ffff695f000) at js/src/gc/Allocator.cpp:225 #21 0x0000000000d81759 in js::gc::GCRuntime::checkAllocatorState<(js::AllowGC)1> (this=0x7ffff695f9b0, cx=0x7ffff695f000, kind=kind@entry=js::gc::AllocKind::STRING) at js/src/gc/Allocator.cpp:189 #22 0x0000000000d8c42c in js::Allocate<JSString, (js::AllowGC)1> (cx=cx@entry=0x7ffff695f000) at js/src/gc/Allocator.cpp:139 #23 0x0000000000be2541 in JSFlatString::new_<(js::AllowGC)1, unsigned char> (cx=cx@entry=0x7ffff695f000, chars=0x7ffff6997ca0 "test.js line 5 > Function", length=length@entry=25) at js/src/vm/String-inl.h:223 #24 0x0000000000be27c1 in js::NewStringCopyNDontDeflate<(js::AllowGC)1, unsigned char> (cx=0x7ffff695f000, s=0x7ffff6997b80 "test.js line 5 > Function", n=25) at js/src/vm/String.cpp:1269 #25 0x00000000008babab in js::NewStringCopyN<(js::AllowGC)1> (n=<optimized out>, s=0x7ffff6997b80 "test.js line 5 > Function", cx=0x7ffff695f000) at js/src/vm/String.h:1190 #26 js::NewStringCopyZ<(js::AllowGC)1> (s=0x7ffff6997b80 "test.js line 5 > Function", cx=0x7ffff695f000) at js/src/vm/String.h:1210 #27 JS_NewStringCopyZ (cx=cx@entry=0x7ffff695f000, s=0x7ffff6997b80 "test.js line 5 > Function") at js/src/jsapi.cpp:4914 #28 0x000000000092ccce in js::ErrorToException (cx=0x7ffff695f000, reportp=0x7fffffffc060, callback=<optimized out>, userRef=<optimized out>) at js/src/jsexn.cpp:544 #29 0x0000000000931abc in js::ReportErrorNumberVA (cx=0x7ffff695f000, flags=flags@entry=0, callback=0x921750 <js::GetErrorMessage(void*, unsigned int)>, userRef=0x0, errorNumber=<optimized out>, argumentsType=argumentsType@entry=js::ArgumentsAreLatin1, ap=0x7fffffffc110) at js/src/jscntxt.cpp:693 #30 0x00000000008bde11 in JS_ReportErrorNumberLatin1VA (cx=<optimized out>, errorCallback=<optimized out>, userRef=<optimized out>, errorNumber=<optimized out>, ap=ap@entry=0x7fffffffc110) at js/src/jsapi.cpp:5588 #31 0x00000000008bdeb8 in JS_ReportErrorNumberLatin1 (cx=cx@entry=0x7ffff695f000, errorCallback=errorCallback@entry=0x921750 <js::GetErrorMessage(void*, unsigned int)>, userRef=userRef@entry=0x0, errorNumber=errorNumber@entry=1) at js/src/jsapi.cpp:5577 #32 0x0000000000926da5 in js::ReportIsNotDefined (cx=cx@entry=0x7ffff695f000, id=id@entry=...) at js/src/jscntxt.cpp:754 #33 0x000000000092d075 in js::ReportIsNotDefined (cx=0x7ffff695f000, name=..., name@entry=...) at js/src/jscntxt.cpp:763 #34 0x00000000006f5a00 in js::FetchName<false> (cx=0x7ffff695f000, obj=..., obj2=..., name=..., shape=..., vp=...) at js/src/vm/Interpreter-inl.h:185 #35 0x0000000000b254b8 in GetNameOperation (vp=..., pc=<optimized out>, fp=<optimized out>, cx=<optimized out>) at js/src/vm/Interpreter.cpp:232 #36 Interpret (cx=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:3064 #37 0x0000000000b310ad in js::RunScript (cx=cx@entry=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:404 #38 0x0000000000b313e5 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff695f000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:476 #39 0x0000000000b31616 in InternalCall (cx=cx@entry=0x7ffff695f000, args=...) at js/src/vm/Interpreter.cpp:503 #40 0x0000000000b3176e in js::Call (cx=cx@entry=0x7ffff695f000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:522 #41 0x00000000008fc43f in JS_CallFunction (cx=cx@entry=0x7ffff695f000, obj=..., fun=..., fun@entry=..., args=..., rval=..., rval@entry=...) at js/src/jsapi.cpp:2786 #42 0x0000000000cbd60b in OOMTest (cx=cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:1392 #43 0x0000000000b40ee9 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0xcbd2e0 <OOMTest(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239 [...] #56 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:7928 rax 0x0 0 rbx 0x7fffffffb5b0 140737488336304 rcx 0x7ffff6c28a2d 140737333332525 rdx 0x0 0 rsi 0x7ffff6ef7770 140737336276848 rdi 0x7ffff6ef6540 140737336272192 rbp 0x7fffffffb550 140737488336208 rsp 0x7fffffffb530 140737488336176 r8 0x7ffff6ef7770 140737336276848 r9 0x7ffff7fe4740 140737354024768 r10 0x58 88 r11 0x7ffff6b9f750 140737332770640 r12 0x7fffffffb910 140737488337168 r13 0x7fffffffb930 140737488337200 r14 0x7fffffffb8c0 140737488337088 r15 0x7fffffffb620 140737488336416 rip 0xdb21f8 <js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup(js::gc::Cell* const&, unsigned int, unsigned int) const+584> => 0xdb21f8 <js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup(js::gc::Cell* const&, unsigned int, unsigned int) const+584>: movl $0x0,0x0 0xdb2203 <js::detail::HashTable<js::gc::Cell* const, js::HashSet<js::gc::Cell*, js::DefaultHasher<js::gc::Cell*>, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookup(js::gc::Cell* const&, unsigned int, unsigned int) const+595>: ud2

Ugh, so this was dumb. I broke the heap checking zeal mode when I changed this code to ignore errors. The fix is to get the condition on the if statement the right way round.

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/c00f9da4f27d user: Tooru Fujisawa date: Sat Oct 01 16:23:25 2016 +0900 summary: Bug 1283710 - Part 7: Use UTF-8 in js::ExpandErrorArgumentsVA and AutoMessageArgs. r=jwalden This iteration took 258.124 seconds to run.

Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/b1d62e7171ef Make heap checking zeal mode work again r=lth

Jon, would it be a good idea to uplift this to 51 ? If we do it before next Monday it can still make it to 51 before the merge to beta.

There's no user impact to this so I think we can leave it.