Last Comment Bug 757304 - IonMonkey: "Assertion failure: trc->runtime->gcIncrementalState == NO_INCREMENTAL || trc->runtime->gcIncrementalState == MARK_ROOTS,"
: IonMonkey: "Assertion failure: trc->runtime->gcIncrementalState == NO_INCREME...
Status: VERIFIED FIXED
: assertion, sec-critical, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
:
Mentors:
Depends on:
Blocks: jsfunfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-05-21 18:20 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-06-27 11:20 PDT (History)
7 users (show)
gary: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (6.92 KB, text/plain)
2012-05-21 18:20 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Fix marking of the invalidator (261 bytes, patch)
2012-05-22 15:13 PDT, Nicolas B. Pierron [:nbp]
nicolas.b.pierron: review+
Details | Diff | Review
Fix marking of the invalidator (1.33 KB, patch)
2012-05-22 15:16 PDT, Nicolas B. Pierron [:nbp]
nicolas.b.pierron: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-05-21 18:20:13 PDT
Created attachment 625844 [details]
stack

The upcoming testcase asserts js debug shell on IonMonkey changeset d80602d38aa8 without any CLI arguments at Assertion failure: trc->runtime->gcIncrementalState == NO_INCREMENTAL || trc->runtime->gcIncrementalState == MARK_ROOTS,

s-s because gc is on the stack, tested after bug 756659 landed on IonMonkey.
Comment 2 Nicolas B. Pierron [:nbp] 2012-05-21 18:43:53 PDT
This bug is located after https://bugzilla.mozilla.org/page.cgi?id=splinter.html&bug=756659&attachment=625833 modifications.

This means that the InvalidationThunk has already been collected and that we are marking it too late or that the IonCode is not traced the first time which cause the invalidation thunk to be garbage collected.
Comment 3 Nicolas B. Pierron [:nbp] 2012-05-21 18:50:15 PDT
(In reply to Nicolas B. Pierron [:pierron] from comment #2)
> This means that the InvalidationThunk has already been collected and that we
> are marking it too late or that the IonCode is not traced the first time
> which cause the invalidation thunk to be garbage collected.

Oops, I was confused by the NULL pointer, which is not the invalidation but related to the tracer.

I wonder why we use MarkIonCodeRoot because root marking is supposed to be an unconditional marking of objects living on the stack.
Comment 4 David Anderson [:dvander] 2012-05-21 19:13:23 PDT
MarkIonCodeRoot is used for exactly the reason you described (if an invalidated script is on the stack, there must be an invalidator thunk as well, and we have to mark it).
Comment 5 Nicolas B. Pierron [:nbp] 2012-05-22 15:13:22 PDT
Created attachment 626203 [details] [diff] [review]
Fix marking of the invalidator

This patch has been reviewed by dvander.

The test case is still not working yet, and would likely be fixed after the next merge with mozilla-central including changes made in Bug 756732.
Comment 6 Nicolas B. Pierron [:nbp] 2012-05-22 15:16:56 PDT
Created attachment 626206 [details] [diff] [review]
Fix marking of the invalidator

Oops, … Same comment, with the real patch this time.
Comment 7 Nicolas B. Pierron [:nbp] 2012-05-22 15:23:48 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/9602aebd7e43

Should be marked as resolved after the merge with Bug 756732. (changeset 9de1e72ad539)
Comment 8 Nicolas B. Pierron [:nbp] 2012-05-24 16:44:12 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/a15a3a3b4647 (merge importing changeset 9de1e72ad539 modifications)
Comment 9 Christian Holler (:decoder) 2012-06-06 03:17:27 PDT
JSBugMon: This bug has been automatically verified fixed.
Comment 10 Gary Kwong [:gkw] [:nth10sd] 2012-06-27 11:20:42 PDT
Large fragile testcase -> in-testsuite-

Note You need to log in before you can comment on or make changes to this bug.