Last Comment Bug 708805 - Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3529
: Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3529
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla11
Assigned To: Bill McCloskey (:billm)
:
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-12-08 13:02 PST by Christian Holler (:decoder)
Modified: 2013-01-14 08:09 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (3.54 KB, patch)
2011-12-08 19:41 PST, Bill McCloskey (:billm)
bhackett1024: review+
Details | Diff | Review

Description Christian Holler (:decoder) 2011-12-08 13:02:56 PST
The following test asserts on mozilla-central revision 6785d3003414 (options -m -n -a):


gczeal(4);
test();
function test()
eval("with({}) let(x=[])(function(){#2=x})()");


Not s-s due to incremental GC relatedness.
Comment 1 Bill McCloskey (:billm) 2011-12-08 19:41:36 PST
Created attachment 580282 [details] [diff] [review]
patch

Another great test. I'm not sure how I missed this barrier.
Comment 2 Brian Hackett (:bhackett) 2011-12-08 19:45:48 PST
This field didn't exist before objshrink.  I must be missing something, as I didn't think that incremental barriers were needed at all for fields that are only written at the point of object creation (as the function's environment is).  I can see how the HeapPtr is needed for generational write barriers though, are the gczeal(4) asserts stronger than is required for incremental GC?
Comment 3 Bill McCloskey (:billm) 2011-12-08 20:40:26 PST
(In reply to Brian Hackett (:bhackett) from comment #2)
> I must be missing something, as I
> didn't think that incremental barriers were needed at all for fields that
> are only written at the point of object creation (as the function's
> environment is).

There is a write in CloneFunctionObjectIfNotSingleton that is on a pre-existing object.

The verifier currently checks only what's needed for incremental GC. Terrence is working on checks for generational.
Comment 5 Ed Morley [:emorley] 2011-12-16 06:12:55 PST
https://hg.mozilla.org/mozilla-central/rev/3a190f6b9ee3
Comment 6 Christian Holler (:decoder) 2013-01-14 08:09:06 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug708805.js.

Note You need to log in before you can comment on or make changes to this bug.