Closed Bug 1017150 Opened 6 years ago Closed 5 years ago

Breakpoint sweeping asserts with zone GCs

Categories

(Core :: JavaScript: GC, defect)

x86_64
Linux
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla32

People

(Reporter: billm, Assigned: billm)

References

Details

Attachments

(1 file)

Attached patch breakpoint-fixSplinter Review
Bug 1016738 causes us to do more zone GCs, and that patch uncovered this problem. Just because a debuggee compartment is being collected, we can't assume that the debugger compartment is also being collected.
Attachment #8430207 - Flags: review?(jcoppeard)
Comment on attachment 8430207 [details] [diff] [review]
breakpoint-fix

Review of attachment 8430207 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/gc/Zone.cpp
@@ +156,5 @@
>              Breakpoint *nextbp;
>              for (Breakpoint *bp = site->firstBreakpoint(); bp; bp = nextbp) {
>                  nextbp = bp->nextInSite();
> +                HeapPtrObject &dbgobj = bp->debugger->toJSObjectRef();
> +                JS_ASSERT_IF(dbgobj->zone()->isCollecting(), dbgobj->zone()->isGCSweeping());

Ah yes, this makes more sense.

@@ +161,2 @@
>                  bool dying = scriptGone || IsObjectAboutToBeFinalized(&dbgobj);
> +                JS_ASSERT_IF(!dying, IsAboutToBeFinalized(&bp->getHandlerRef()));

Did you mean to reverse the sense of this?  I agree with using IsAboutToBeFinalized() in preference to isMarked() though.
Attachment #8430207 - Flags: review?(jcoppeard) → review+
Yes, I did reverse the isMarked test. Thanks for pointing it out.

https://hg.mozilla.org/integration/mozilla-inbound/rev/c3ce56241969
I'm pretty sure the problem is in bug 1016738. It causes us to do more zone GCs, and there's probably some existing problem that gets triggered by that. Could you please back out 93c5b9181c84? I'm about to get on a plane.
Flags: needinfo?(wmccloskey) → needinfo?(kwierso)
https://hg.mozilla.org/mozilla-central/rev/64788916250a
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
You need to log in before you can comment on or make changes to this bug.