Last Comment Bug 756236 - IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4466
: IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing))...
: assertion, sec-critical, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
-- major (vote)
: ---
Assigned To: David Anderson [:dvander]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-05-17 13:17 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:19 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (3.07 KB, patch)
2012-05-18 11:49 PDT, David Anderson [:dvander]
sstangl: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-05-17 13:17:07 PDT
The following testcase asserts on ionmonkey revision 14735b4dbccc (run with --ion -n -m --ion-eager):

function startTest() {}
function TestCase(n, d, e, a)
    dump = (function () {});
  if (typeof document != "object" || !document.location.href.match(/jsreftest.html/)) {}
function writeHeaderToLog( string ) {}
var SECTION = "11.4.5";
new TestCase( SECTION,  "var MYVAR= void 0; --MYVAR", NaN, eval("var MYVAR=void 0; --MYVAR") );
new TestCase( SECTION, "var MYVAR=0;--MYVAR;MYVAR", -1, eval("var MYVAR=0;--MYVAR;MYVAR") );
new TestCase( SECTION, "var MYVAR=0;--MYVAR;MYVAR", -1, eval("var MYVAR=0;--MYVAR;MYVAR") );
Comment 1 User image David Anderson [:dvander] 2012-05-18 02:11:53 PDT
Bug is that setprop ICs don't emit write barriers. Patch tomorrow.
Comment 2 User image David Anderson [:dvander] 2012-05-18 11:49:56 PDT
Created attachment 625184 [details] [diff] [review]

I added some stuff to MacroAssembler so we don't have to make an AutoIonContextAlloc thing everywhere.
Comment 3 User image Sean Stangl [:sstangl] 2012-05-18 14:27:23 PDT
Comment on attachment 625184 [details] [diff] [review]

Review of attachment 625184 [details] [diff] [review]:

::: js/src/ion/IonCaches.cpp
@@ +346,5 @@
>      if (obj->isFixedSlot(shape->slot())) {
>          Address addr(object(), JSObject::getFixedSlotOffset(shape->slot()));
> +
> +        if (cx->compartment->needsBarrier())

Since ICs are flushed with GC, this code can remain as-is even with the patch preserving Ion code. As a note to myself, I should remember to leave a comment here.
Comment 4 User image David Anderson [:dvander] 2012-05-18 15:41:04 PDT
Thanks for the quick review -
Comment 5 User image Christian Holler (:decoder) 2012-05-18 16:50:31 PDT
JSBugMon: This bug has been automatically verified fixed.
Comment 6 User image Christian Holler (:decoder) 2013-02-07 05:19:57 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.