779073 - "Assertion failure: any" with verifyprebarriers()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase

The testcase requires https://www.squarefree.com/extensions/domFuzzLite3.xpi

Assertion failure: any, at js/src/jsgc.cpp:3716

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This is caused by a bookkeeping problem. During a write barrier verification, we set gcIncrementalState to MARK. Later on, we assume that when that is set, then some compartment must have already been scheduled for incremental GC, which is wrong. I need to decide how to fix this.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

This fixes the problem.

Comment 3

[Terrence Cole [:terrence]]

Comment on attachment 664585 [details] [diff] [review]
patch

Review of attachment 664585 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7dfbdeb9f9ca

Comment 5

[Mounir Lamouri (:mounir)]

https://hg.mozilla.org/mozilla-central/rev/7dfbdeb9f9ca