Last Comment Bug 702915 - Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3556
: Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3556
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: mozilla11
Assigned To: Bill McCloskey (:billm)
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-11-16 02:52 PST by Christian Holler (:decoder)
Modified: 2013-01-19 14:18 PST (History)
3 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Test case for shell (run with -n -m -a) (3.28 KB, application/javascript)
2011-11-16 02:52 PST, Christian Holler (:decoder)
no flags Details
fix (3.67 KB, patch)
2011-11-16 11:47 PST, Bill McCloskey (:billm)
bhackett1024: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-11-16 02:52:59 PST
Created attachment 574857 [details]
Test case for shell (run with -n -m -a)

The attached test asserts on mozilla-central revision d51bd1645a2f (options -m -n -a). Test might be 64 bit only.

Stack (partial):

#0  0x00007ffff7bcdb3b in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#1  0x00000000005c0dd2 in CrashInJS () at /srv/repos/mozilla-central/js/src/jsutil.cpp:95
#2  0x00000000005c0e2a in JS_Assert (s=0x78f990 "static_cast<Cell *>(thing)->isMarked()", file=0x78ed10 "/srv/repos/mozilla-central/js/src/jsgc.cpp", ln=3556)
    at /srv/repos/mozilla-central/js/src/jsutil.cpp:103
#3  0x00000000004afb87 in js::gc::EndVerifyBarriers (cx=0xb40ee0) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3556
#4  0x00000000004ae22b in AutoVerifyBarriers::AutoVerifyBarriers (this=0x7fffffffaa50, cx=0xb40ee0) at /srv/repos/mozilla-central/js/src/jsgc.cpp:2985
#5  0x00000000004ae2f5 in js_GC (cx=0xb40ee0, comp=0x0, gckind=GC_NORMAL, reason=js::gcstats::LASTDITCH) at /srv/repos/mozilla-central/js/src/jsgc.cpp:2988
#6  0x00000000004aba55 in js::gc::RunLastDitchGC (cx=0xb40ee0) at /srv/repos/mozilla-central/js/src/jsgc.cpp:1622
#7  0x00000000004aef6a in js::gc::RunDebugGC (cx=0xb40ee0) at /srv/repos/mozilla-central/js/src/jsgc.cpp:3251
#8  0x0000000000570d03 in NewGCThing<js::Shape> (cx=0xb40ee0, kind=js::gc::FINALIZE_SHAPE, thingSize=64) at ../jsgcinlines.h:351
#9  0x00000000005706d9 in js_NewGCShape (cx=0xb40ee0) at ../jsgcinlines.h:408
#10 0x000000000056eab6 in js::PropertyTree::newShape (this=0xb41918, cx=0xb40ee0) at /srv/repos/mozilla-central/js/src/jspropertytree.cpp:70
#11 0x000000000056f1c7 in js::PropertyTree::getChild (this=0xb41918, cx=0xb40ee0, parent=0x7ffff6019c40, child=...) at /srv/repos/mozilla-central/js/src/jspropertytree.cpp:205
#12 0x0000000000580f8a in JSObject::getChildProperty (this=0x7ffff6007230, cx=0xb40ee0, parent=0x7ffff6019c40, child=...) at /srv/repos/mozilla-central/js/src/jsscope.cpp:451
#13 0x0000000000581e87 in JSObject::addPropertyInternal (this=0x7ffff6007230, cx=0xb40ee0, id=..., getter=0, setter=0, slot=9, attrs=1, flags=0, shortid=0, spp=0x7ffff60199f0)
    at /srv/repos/mozilla-central/js/src/jsscope.cpp:691
#14 0x0000000000581c63 in JSObject::addProperty (this=0x7ffff6007230, cx=0xb40ee0, id=..., getter=0, setter=0, slot=9, attrs=1, flags=0, shortid=0)
    at /srv/repos/mozilla-central/js/src/jsscope.cpp:656
#15 0x00000000004589e2 in JSObject::addDataProperty (this=0x7ffff6007230, cx=0xb40ee0, id=..., slot=9, attrs=1) at /srv/repos/mozilla-central/js/src/jsobj.h:1328
#16 0x000000000044e603 in JSObject::makeDenseArraySlow (this=0x7ffff6007230, cx=0xb40ee0) at /srv/repos/mozilla-central/js/src/jsarray.cpp:1414
#17 0x000000000044d511 in array_setGeneric (cx=0xb40ee0, obj=0x7ffff6007230, id=..., vp=0x7fffffffb010, strict=0) at /srv/repos/mozilla-central/js/src/jsarray.cpp:924
#18 0x0000000000529304 in JSObject::nonNativeSetProperty (this=0x7ffff6007230, cx=0xb40ee0, id=..., vp=0x7fffffffb010, strict=0)
    at /srv/repos/mozilla-central/js/src/jsobj.cpp:3679
#19 0x0000000000442f96 in JSObject::setGeneric (this=0x7ffff6007230, cx=0xb40ee0, id=..., vp=0x7fffffffb010, strict=0) at ../jsobjinlines.h:139
#20 0x000000000076cc26 in js::mjit::stubs::SetElem<0> (f=...) at /srv/repos/mozilla-central/js/src/methodjit/StubCalls.cpp:583
#21 0x000000000066dc84 in throwpoline_exit () at /srv/repos/mozilla-central/js/src/methodjit/MethodJIT.cpp:164
#22 0x000000000066df4c in js::mjit::EnterMethodJIT (cx=0xb40ee0, fp=0x7ffff63fb158, code=0x7ffff7f5b2c0, stackLimit=0x7ffff67db000, partial=true)
    at /srv/repos/mozilla-central/js/src/methodjit/MethodJIT.cpp:1064

As the test uses gczeal(4) and has js::gc::EndVerifyBarriers on the stack, I assume this is only related to incremental GC and not security critical for our current builds.
Comment 1 User image Bill McCloskey (:billm) 2011-11-16 11:47:54 PST
Created attachment 574952 [details] [diff] [review]

This bug turns out to be a false positive related to the fix for bug 701682.

The barrier verifier checks a stricter condition than what is needed for incremental GC correctness. For incremental GC, we only require that pointers that have been overwritten are marked by the end of the GC. The verifier only checks mark bits set by the barriers--it doesn't take into account root scanning. In the array slowification code, we rely on an autorooter to keep the array slots marked. So this patch just adds autorooter marking to the verifier.
Comment 3 User image Ed Morley [:emorley] 2011-11-19 05:11:56 PST
Comment 4 User image Christian Holler (:decoder) 2013-01-19 14:18:48 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.