1038396 - Assertion failure: !(thing->zone()->isGCSweeping() || thing->zone()->isGCFinished()), at gc/Marking.cpp or Assertion failure: *ptr == 0xE9, at jit/shared/Assembler-x86-shared.h

Status: VERIFIED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

The attached testcase asserts js debug shell on m-c changeset 340b19c14d3d with --baseline-eager at Assertion failure: !(thing->zone()->isGCSweeping() || thing->zone()->isGCFinished()), at gc/Marking.cpp

Tested using:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1405343714/jsshell-mac64.zip

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140711133913" and the hash "e0a49f64ef4f".
The "bad" changeset has the timestamp "20140711135424" and the hash "7c366c305105".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e0a49f64ef4f&tochange=7c366c305105

Note that this is fairly intermittent and the gcslice value can change. Also, setting s-s but not adding a rating as I'm not sure how the gcslice function can affect real-world usage.

Terrence, is bug 1017165 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack without symbols

The js shells from tbpl do not have useful stacks.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

RyanVM told me over IRC that bug 1017165 got backed out, which probably fixed this.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.