1057219 - Assertion failure: [barrier verifier] Unmarked edge: objectElementsOwner, at gc/Verifier.cpp:316

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision dac8b4a0bd7c (run with --no-threads --fuzzing-safe):


gczeal(4,1);
var N = 100;
function basic(out) {
  for (var i = 0; i < N; i++) {
    var arr = [0, 1, 2, 3, 4];
    arr.length = 6;
  }
}
basic();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Marked s-s because it's gc-related.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9605a571ca8a
user:        Brian Hackett
date:        Tue Aug 19 22:25:37 2014 -0800
summary:     Bug 934450 - Allow objects to have copy on write elements, r=billm,jandem.

This iteration took 288.677 seconds to run.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

There should be a write barrier on the owner object pointer when we copy an object's copy-on-write elements for a write.  This pointer is traced through during GC so that the elements stay alive, but isn't used in any other way, so I don't think the lack of this barrier can cause any problems.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9d7eb12460ce

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9d7eb12460ce