Closed Bug 1292664 Opened 3 years ago Closed 3 years ago

Intermittent browser_perf-recording-selected-03.js | application crashed [@ js::jit::JitcodeGlobalTable::lookupForSamplerInfallible(void *,JSRuntime *,unsigned int)] after Assertion failure: entry->isMarkedFromAnyThread(rt)

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
firefox51 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

Details

(Keywords: intermittent-failure)

Attachments

(1 file)

This is an assertion failure in JitcodeGlobalTable::lookupForSamplerInfallible on the sampler thread.  The main thread is suspended while in the process of resetting an incremental GC and was sweeping.

Apart from the fact that this whole setup seems inherently risky, the assertion doesn't take account of zone GCs or resets.  What probably happened is that a full GC cleared the mark bits for the zone in question but a reset cancelled the sweeping of the zone so the table entries were not marked.
Assignee: nobody → jcoppeard
Attachment #8778837 - Flags: review?(terrence)
Comment on attachment 8778837 [details] [diff] [review]
bug1292664-jitcode-table-assert

Review of attachment 8778837 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, this code is insanity. ISTR that that assertion went through a bunch of different variations and I think one of them was just checking the zone's sweep status? Anyway, let's find out!
Attachment #8778837 - Flags: review?(terrence) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5d5d3ef04f3f
Improve GC state assertion in JitcodeGlobalTable r=terrence
https://hg.mozilla.org/mozilla-central/rev/5d5d3ef04f3f
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
You need to log in before you can comment on or make changes to this bug.