1096018 - Assertion failure: [barrier verifier] Unmarked edge: reference-val, at gc/Verifier.cpp:316

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision d380166816dd (run with --no-threads --fuzzing-safe):


gczeal(4);
var T = TypedObject;
var ValueStruct = new T.StructType({f: T.Any});
var v = new ValueStruct();
function writeValue(o, v, expectedType, expected) {
    o.f = v;
}
for (var i = 0; i < 500000; i++)
  writeValue(v, { toString: function() { return "helo" } }, "object", "helo");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Marked this bug s-s as it involves the GC. Needinfo from :nmatsakis due to TypedObject being involved.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/4bdc3391644e
user:        Brian Hackett
date:        Tue Nov 04 18:21:47 2014 -0700
summary:     Bug 1091329 - Optimize writes to reference members of TypedObjects, r=nmatsakis,jandem.

This iteration took 7.595 seconds to run.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision d380166816dd).

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

I haven't been able to reproduce this, on either trunk or the reported revision, but this patch should fix the problem.  MStoreElement needs to be told whether it needs to include a pre barrier.  (StoreUnboxedObjectOrNull/String always include the barrier.)

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8edd196e6d87

Comment 7

[Andrew McCreight [:mccr8]]

TypedObject is disabled everywhere except Nightly, so any B2G release should be unaffected.

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8edd196e6d87

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This landed on m-c as per comment 8.

Comment 10

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.
JSBugMon: This bug has been automatically verified fixed on Fx36