Closed
Bug 729793
Opened 12 years ago
Closed 12 years ago
IonMonkey: "Assertion failure: trc->runtime->gcIncrementalState == NO_INCREMENTAL || trc->runtime->gcIncrementalState == MARK_ROOTS,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Assigned: dvander)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(3 files)
The upcoming testcase asserts js debug shell on IonMonkey changeset 5a04fd69aa09 with -m, --ion and -n at Assertion failure: trc->runtime->gcIncrementalState == NO_INCREMENTAL || trc->runtime->gcIncrementalState == MARK_ROOTS,
Assignee | ||
Comment 3•12 years ago
|
||
Gary, can you still reproduce this? I can't reproduce it on x86/x64 on either tip or the given cset.
Reporter | ||
Comment 4•12 years ago
|
||
> Gary, can you still reproduce this? I can't reproduce it on x86/x64 on
> either tip or the given cset.
Yes, I can still reproduce on 64-bit debug shell on Linux, IonMonkey changeset 294792e20d15.
If I'm right, we seem to be failing somewhere in the function located at line 34, which is the testOne() function.
It looks like the problem here is that IonMonkey is calling MarkThingOrValueRoot on something that's not a root. By definition, roots are things that are traced from MarkRuntime. And this is happening later. The fix for this depends on whether the thing being traced needs a write barrier or not.
Reporter | ||
Comment 6•12 years ago
|
||
> Gary, can you still reproduce this? I can't reproduce it on x86/x64 on
> either tip or the given cset.
I just sent a mail containing a coredump too.
Assignee | ||
Comment 7•12 years ago
|
||
Bug is that we were using root marking functions during tracing, which isn't allowed. I'm not sure if this is the best fix but I created a non-root variant of MarkGCThingOrValue which is ion-specific.
Comment on attachment 602553 [details] [diff] [review] fix Review of attachment 602553 [details] [diff] [review]: ----------------------------------------------------------------- Could you call the new function MarkThingOrValueUnbarriered? And could you comment in the places where it's called that the value is constant, so there's no need for a barrier?
Attachment #602553 -
Flags: review?(wmccloskey) → review+
Assignee | ||
Comment 9•12 years ago
|
||
pushed w/ nits fixed: http://hg.mozilla.org/projects/ionmonkey/rev/5a8324ecec35
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•