Last Comment Bug 754712 - IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at js/src/jsgc.cpp:4465
: IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing))...
Status: VERIFIED FIXED
[jsbugmon:update]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-05-13 15:05 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:18 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected


Attachments
Testcase for shell (1.08 KB, text/javascript)
2012-05-13 15:05 PDT, Christian Holler (:decoder)
no flags Details
fix (1.75 KB, patch)
2012-05-16 10:12 PDT, David Anderson [:dvander]
wmccloskey: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-05-13 15:05:33 PDT
Created attachment 623528 [details]
Testcase for shell

The attached testcase asserts on ionmonkey revision e8de64e7e9fe (run with --ion -n -m --ion-eager).
Comment 1 Bill McCloskey (:billm) 2012-05-15 15:43:23 PDT
Talking this over with David. It sounds like the IonScript is linked off a JSScript, and it has a trace method. If we ever kill the IonScript during an incremental GC (due to invalidation, say), then all the objects that would have been traced by the IonScript need to be marked immediately, as a kind of custom write barrier. The patch in bug 754150 has an almost exactly similar case for JaegerMonkey, and I imagine the IonMonkey patch would be similar.
Comment 2 David Anderson [:dvander] 2012-05-16 10:12:28 PDT
Created attachment 624434 [details] [diff] [review]
fix

Thanks for helping me diagnose this, Bill. The test case no longer reproduces on tip, but this is definitely a bug and this patch appears to fix it from when it did reproduce a few days ago.
Comment 3 Bill McCloskey (:billm) 2012-05-16 10:15:11 PDT
Comment on attachment 624434 [details] [diff] [review]
fix

Review of attachment 624434 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/Ion.cpp
@@ +1154,5 @@
> +            IonScript *ionScript = script->ion;
> +
> +            JSCompartment *compartment = script->compartment();
> +            if (compartment->needsBarrier()) {
> +                // We're about to remove edges from the JSScipt to gcthings

JScript -> JSScript
Comment 4 David Anderson [:dvander] 2012-05-16 13:22:26 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/9caa6deab767
Comment 5 Christian Holler (:decoder) 2012-05-18 04:35:14 PDT
JSBugMon: This bug has been automatically verified fixed.
Comment 6 Christian Holler (:decoder) 2013-02-07 05:18:00 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.