Last Comment Bug 756236 - IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4466
: IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing))...
Status: VERIFIED FIXED
[jsbugmon:update]
: assertion, sec-critical, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
:
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-05-17 13:17 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:19 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected


Attachments
fix (3.07 KB, patch)
2012-05-18 11:49 PDT, David Anderson [:dvander]
sstangl: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-05-17 13:17:07 PDT
The following testcase asserts on ionmonkey revision 14735b4dbccc (run with --ion -n -m --ion-eager):


gczeal(4);
function startTest() {}
function TestCase(n, d, e, a)
    dump = (function () {});
  if (typeof document != "object" || !document.location.href.match(/jsreftest.html/)) {}
function writeHeaderToLog( string ) {}
var SECTION = "11.4.5";
new TestCase( SECTION,  "var MYVAR= void 0; --MYVAR", NaN, eval("var MYVAR=void 0; --MYVAR") );
new TestCase( SECTION, "var MYVAR=0;--MYVAR;MYVAR", -1, eval("var MYVAR=0;--MYVAR;MYVAR") );
new TestCase( SECTION, "var MYVAR=0;--MYVAR;MYVAR", -1, eval("var MYVAR=0;--MYVAR;MYVAR") );
Comment 1 David Anderson [:dvander] 2012-05-18 02:11:53 PDT
Bug is that setprop ICs don't emit write barriers. Patch tomorrow.
Comment 2 David Anderson [:dvander] 2012-05-18 11:49:56 PDT
Created attachment 625184 [details] [diff] [review]
fix

I added some stuff to MacroAssembler so we don't have to make an AutoIonContextAlloc thing everywhere.
Comment 3 Sean Stangl [:sstangl] 2012-05-18 14:27:23 PDT
Comment on attachment 625184 [details] [diff] [review]
fix

Review of attachment 625184 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonCaches.cpp
@@ +346,5 @@
>  
>      if (obj->isFixedSlot(shape->slot())) {
>          Address addr(object(), JSObject::getFixedSlotOffset(shape->slot()));
> +
> +        if (cx->compartment->needsBarrier())

Since ICs are flushed with GC, this code can remain as-is even with the patch preserving Ion code. As a note to myself, I should remember to leave a comment here.
Comment 4 David Anderson [:dvander] 2012-05-18 15:41:04 PDT
Thanks for the quick review - https://bugzilla.mozilla.org/show_bug.cgi?id=756236
Comment 5 Christian Holler (:decoder) 2012-05-18 16:50:31 PDT
JSBugMon: This bug has been automatically verified fixed.
Comment 6 Christian Holler (:decoder) 2013-02-07 05:19:57 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.