dart vm segmentation fault

[DartBot]

This issue was originally filed by @darrellpf

---

What steps will reproduce the problem?

1. Run the attached dart program
   2.

What is the expected output? What do you see instead?

VM segfaults

What version of the product are you using? On what operating system?

This is the dart from editor 5692 build. (I couldn't find a dart vm command that would give a version)

Please provide any additional information below.

The program is a Java brain trying to turn on a Dart brain. It isn't full of glowing Dart-isms (yet)

---

Attachment:
stadiumprint.dart (1.78 KB)

[DartBot]

This comment was originally written by @darrellpf

---

OS is Fedora rawhide.

[iposva-google]

Added Area-VM, Triaged labels.

[sethladd]

cc @sigmundch.
Added Isolates label.

[turnidge]

Set owner to @turnidge.
Added Started label.

[turnidge]

I am only able to reproduce the problem in Release mode.

The initializer for someVar is required to elicit the failure. The value of the initializer seems to affect the address that we see in our crash. Crashes look like this:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000007
[Switching to process 7945]
0x0001e5d4 in dart::Object::SetRaw (this=0xb00204bc, value=0x514467d) at object.h:4906
4906 handle_vtable_ : raw_->ptr()->class_->ptr()->handle_vtable_);

Here's a shorter test program to elicit the failure:

---

#import('dart:isolate');

class Foo {
  const Foo();
}

class TestClass {
  var _someVar = 0;

  void getValue() {
  }
}

void helperIsolate() {
  // print('ENTER helperIsolate');

  var test = new TestClass();
  // print('CREATED TestClass');

  test.getValue();
  // print('CALLED function');
  // print("CALLING FUNCTION ${test.getValue()}");

  // print('EXIT helperIsolate');
}

void main() {
  ReceivePort rp = new ReceivePort();
  var test = new TestClass();
  test.getValue();

  // helperIsolate();
  SendPort helper = spawnFunction(helperIsolate);
}

[turnidge]

Ok.

I'm sorry it took so long to get to this bug. The behavior was pretty broken. We were never finalizing classes for new isolates spawned by the new api in Release mode. This was causing all of the object sizes to be zero with boggling effects. Normally, we would catch such an issue in Debug mode, with a nice explanatory message, BUT, I was finalizing classes inside an ASSERT. I had cribbed this code from the old isolate api, but neglected to notice that they were actually finalizing the classes at a different point, deep in a helper method that was getting used for error checking.

Long story, short, it's fixed now in bleeding_edge r8079. It may take a bit to migrate up to trunk.

---

Added Fixed label.