Last Comment Bug 754712 - IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at js/src/jsgc.cpp:4465
: IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing))...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
-- major (vote)
: ---
Assigned To: David Anderson [:dvander]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-05-13 15:05 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:18 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase for shell (1.08 KB, text/javascript)
2012-05-13 15:05 PDT, Christian Holler (:decoder)
no flags Details
fix (1.75 KB, patch)
2012-05-16 10:12 PDT, David Anderson [:dvander]
wmccloskey: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-05-13 15:05:33 PDT
Created attachment 623528 [details]
Testcase for shell

The attached testcase asserts on ionmonkey revision e8de64e7e9fe (run with --ion -n -m --ion-eager).
Comment 1 User image Bill McCloskey (:billm) 2012-05-15 15:43:23 PDT
Talking this over with David. It sounds like the IonScript is linked off a JSScript, and it has a trace method. If we ever kill the IonScript during an incremental GC (due to invalidation, say), then all the objects that would have been traced by the IonScript need to be marked immediately, as a kind of custom write barrier. The patch in bug 754150 has an almost exactly similar case for JaegerMonkey, and I imagine the IonMonkey patch would be similar.
Comment 2 User image David Anderson [:dvander] 2012-05-16 10:12:28 PDT
Created attachment 624434 [details] [diff] [review]

Thanks for helping me diagnose this, Bill. The test case no longer reproduces on tip, but this is definitely a bug and this patch appears to fix it from when it did reproduce a few days ago.
Comment 3 User image Bill McCloskey (:billm) 2012-05-16 10:15:11 PDT
Comment on attachment 624434 [details] [diff] [review]

Review of attachment 624434 [details] [diff] [review]:

::: js/src/ion/Ion.cpp
@@ +1154,5 @@
> +            IonScript *ionScript = script->ion;
> +
> +            JSCompartment *compartment = script->compartment();
> +            if (compartment->needsBarrier()) {
> +                // We're about to remove edges from the JSScipt to gcthings

JScript -> JSScript
Comment 4 User image David Anderson [:dvander] 2012-05-16 13:22:26 PDT
Comment 5 User image Christian Holler (:decoder) 2012-05-18 04:35:14 PDT
JSBugMon: This bug has been automatically verified fixed.
Comment 6 User image Christian Holler (:decoder) 2013-02-07 05:18:00 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.