777992 - "Assertion failure: [barrier verifier] Unmarked edge: element,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

verifyprebarriers()
x = []
function z() {}
Object.defineProperty(x, 2, {
    value: z
})
gczeal(2, 2)
y = x.slice(2)
y.e = (function() {})

asserts js opt shell on m-c changeset deb98a757d4a without any CLI arguments at Assertion failure: [barrier verifier] Unmarked edge: element,

My opt shell is compiled with --enable-gczeal, --enable-profiling, --enable-debug-symbols, --enable-more-deterministic and --enable-valgrind among others.

s-s because gczeal is involved just-to-be-safe.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(not sure if this is really correct)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99987:139a8f2a8538
user:        Terrence Cole
date:        Wed Jun 20 18:48:56 2012 -0700
summary:     Bug 764962 - Add a verifier mode for GenerationalGC post barriers; r=billm

I verify that the parent changeset 440ac3414c64 of this changeset, does not assert with the following testcase:

verifybarriers()
x = []
function z() {}
Object.defineProperty(x, 2, {
    value: z
})
gczeal(2, 2)
y = x.slice(2)
y.e = (function() {})

(I changed verifyprebarriers() to verifybarriers() here)

Comment 2

[Terrence Cole [:terrence]]

Woohoo! My first sec-crit fuzz bug :-).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Terrence Cole [:terrence] from comment #2)
> Woohoo! My first sec-crit fuzz bug :-).

Setting sec-critical. :)

Comment 4

[Terrence Cole [:terrence]]

Attachment: v0

Bill, thanks for all the help with tracking this down!  I couldn't put the fix quite where we planned for reasons I added to the comment.

What do I need to do to land this?  Do we need a cover bug?  Should I gin up a fake commit message?  Should it land in Aurora and Beta too?

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 646663 [details] [diff] [review]
v0

This affects aurora but not beta. Since this doesn't affect a release, I think it's fine to land on inbound and aurora with a simple commit message like "Move array slowification barrier."

Comment 6

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/71c43f0a8e2c

Comment 7

[David Mandelin [:dmandelin]]

(In reply to Terrence Cole [:terrence] from comment #6)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/71c43f0a8e2c

Since this appears to have stuck on central, could you please nominate for Aurora?

Comment 8

[Terrence Cole [:terrence]]

Comment on attachment 646663 [details] [diff] [review]
v0

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Use after free if incremental GC is triggered in a certain spot.
User impact if declined: Rare crash during Incremental GC.
Testing completed (on m-c, etc.): Has been on m-c for a couple days now.
Risk to taking this patch (and alternatives if risky): Low.
String or UUID changes made by this patch: None.

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 646663 [details] [diff] [review]
v0

low risk, approving for aurora and if you could drop in a mozilla-central url with where this landed as well as update the status flags once this is uplifted that would be appreciated, thank you.

Comment 10

[Terrence Cole [:terrence]]

http://hg.mozilla.org/mozilla-central/rev/71c43f0a8e2c

Comment 11

[Terrence Cole [:terrence]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/1910025519e0

Comment 12

[Terrence Cole [:terrence]]

And backed out in:
https://hg.mozilla.org/releases/mozilla-aurora/rev/e0d6e40bc40b

I forgot that we have updated the name of the verifybarriers() function.

Comment 13

[Terrence Cole [:terrence]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d6b4ac96bdfb

Comment 14

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 15

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug777992.js.