Closed Bug 729793 Opened 8 years ago Closed 8 years ago

IonMonkey: "Assertion failure: trc->runtime->gcIncrementalState == NO_INCREMENTAL || trc->runtime->gcIncrementalState == MARK_ROOTS,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: dvander)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(3 files)

Attached file stack
The upcoming testcase asserts js debug shell on IonMonkey changeset 5a04fd69aa09 with -m, --ion and -n at Assertion failure: trc->runtime->gcIncrementalState == NO_INCREMENTAL || trc->runtime->gcIncrementalState == MARK_ROOTS,
Tested in 64-bit Linux debug js shell.
Hardware: x86 → x86_64
Gary, can you still reproduce this? I can't reproduce it on x86/x64 on either tip or the given cset.
Attached file more information
> Gary, can you still reproduce this? I can't reproduce it on x86/x64 on
> either tip or the given cset.

Yes, I can still reproduce on 64-bit debug shell on Linux, IonMonkey changeset 294792e20d15.

If I'm right, we seem to be failing somewhere in the function located at line 34, which is the testOne() function.
It looks like the problem here is that IonMonkey is calling MarkThingOrValueRoot on something that's not a root. By definition, roots are things that are traced from MarkRuntime. And this is happening later.

The fix for this depends on whether the thing being traced needs a write barrier or not.
> Gary, can you still reproduce this? I can't reproduce it on x86/x64 on
> either tip or the given cset.

I just sent a mail containing a coredump too.
Attached patch fixSplinter Review
Bug is that we were using root marking functions during tracing, which isn't allowed. I'm not sure if this is the best fix but I created a non-root variant of MarkGCThingOrValue which is ion-specific.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #602553 - Flags: review?(wmccloskey)
No longer blocks: 630996
Comment on attachment 602553 [details] [diff] [review]
fix

Review of attachment 602553 [details] [diff] [review]:
-----------------------------------------------------------------

Could you call the new function MarkThingOrValueUnbarriered?

And could you comment in the places where it's called that the value is constant, so there's no need for a barrier?
Attachment #602553 - Flags: review?(wmccloskey) → review+
pushed w/ nits fixed: http://hg.mozilla.org/projects/ionmonkey/rev/5a8324ecec35
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.