Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3529

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla11
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision 6785d3003414 (options -m -n -a):


gczeal(4);
test();
function test()
eval("with({}) let(x=[])(function(){#2=x})()");


Not s-s due to incremental GC relatedness.
(Assignee)

Comment 1

6 years ago
Created attachment 580282 [details] [diff] [review]
patch

Another great test. I'm not sure how I missed this barrier.
Attachment #580282 - Flags: review?(bhackett1024)
This field didn't exist before objshrink.  I must be missing something, as I didn't think that incremental barriers were needed at all for fields that are only written at the point of object creation (as the function's environment is).  I can see how the HeapPtr is needed for generational write barriers though, are the gczeal(4) asserts stronger than is required for incremental GC?
(Assignee)

Comment 3

6 years ago
(In reply to Brian Hackett (:bhackett) from comment #2)
> I must be missing something, as I
> didn't think that incremental barriers were needed at all for fields that
> are only written at the point of object creation (as the function's
> environment is).

There is a write in CloneFunctionObjectIfNotSingleton that is on a pre-existing object.

The verifier currently checks only what's needed for incremental GC. Terrence is working on checks for generational.
Attachment #580282 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 4

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/3a190f6b9ee3
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/3a190f6b9ee3
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 6

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug708805.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.