1032206 - Assertion failure: [barrier verifier] Unmarked edge: <unknown>, at gc/Verifier.cpp:314 with Symbol

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision b6408c32a170 (run with --fuzzing-safe):


gczeal(4);
var symbols = [ Symbol(), Symbol.iterator ];
for (var comparator of [">", ">="])
  for (var a of symbols) {}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Marked s-s because it's GC-related.

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: bug-1032206-gc-v1.patch

Comment 4

[Jason Orendorff [:jorendorff]]

This isn't s-s, as it turns out, because the assertion is bogus. (I introduced a situation the verifier didn't know about and neglected to update the verifier.)

Comment 5

[Terrence Cole [:terrence]]

Comment on attachment 8448260 [details] [diff] [review]
bug-1032206-gc-v1.patch

Review of attachment 8448260 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks! r=me

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d8e2600e9aa3
user:        Jason Orendorff
date:        Mon Jun 23 10:56:49 2014 -0500
summary:     Bug 645417, part 10 - Well-known symbols. r=terrence,r=efaust.

(The commit message had the wrong bug number, it should be bug 645416 instead)

Jason, hopefully this isn't waiting on anything for landing? (fwiw jsfunfuzz hits this)

Comment 7

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1c82a99ef2b7

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1c82a99ef2b7