756236 - IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4466

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 14735b4dbccc (run with --ion -n -m --ion-eager):


gczeal(4);
function startTest() {}
function TestCase(n, d, e, a)
    dump = (function () {});
  if (typeof document != "object" || !document.location.href.match(/jsreftest.html/)) {}
function writeHeaderToLog( string ) {}
var SECTION = "11.4.5";
new TestCase( SECTION,  "var MYVAR= void 0; --MYVAR", NaN, eval("var MYVAR=void 0; --MYVAR") );
new TestCase( SECTION, "var MYVAR=0;--MYVAR;MYVAR", -1, eval("var MYVAR=0;--MYVAR;MYVAR") );
new TestCase( SECTION, "var MYVAR=0;--MYVAR;MYVAR", -1, eval("var MYVAR=0;--MYVAR;MYVAR") );

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Bug is that setprop ICs don't emit write barriers. Patch tomorrow.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

I added some stuff to MacroAssembler so we don't have to make an AutoIonContextAlloc thing everywhere.

Comment 3

[Sean Stangl [:sstangl]]

Comment on attachment 625184 [details] [diff] [review]
fix

Review of attachment 625184 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonCaches.cpp
@@ +346,5 @@
>  
>      if (obj->isFixedSlot(shape->slot())) {
>          Address addr(object(), JSObject::getFixedSlotOffset(shape->slot()));
> +
> +        if (cx->compartment->needsBarrier())

Since ICs are flushed with GC, this code can remain as-is even with the patch preserving Ion code. As a note to myself, I should remember to leave a comment here.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Thanks for the quick review - https://bugzilla.mozilla.org/show_bug.cgi?id=756236

Comment 5

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397