Last Comment Bug 782083 - IonMonkey: Assertion failure: thing, at gc/Marking.cpp:87 or Opt-Crash [@ js::gc::MarkIonCodeRoot]
: IonMonkey: Assertion failure: thing, at gc/Marking.cpp:87 or Opt-Crash [@ js:...
Status: RESOLVED FIXED
[ion:p1:fx18] [jsbugmon:update,ignore]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
: general
:
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-08-11 17:05 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:17 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (1.43 KB, patch)
2012-08-13 17:44 PDT, David Anderson [:dvander]
jdemooij: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-08-11 17:05:28 PDT
The following testcase asserts on ionmonkey revision f1764bf06b29 (run with --ion -n -m --ion-eager):


gcPreserveCode();
function r() {}
gczeal(2);
evaluate("");
evaluate("\
function randomFloat () {\
    if (r < 0.25)\
        fac = 10000000;\
}\
for (var i = 0; i < 100000; i++)\
    randomFloat();\
");
Comment 1 Christian Holler (:decoder) 2012-08-11 17:06:02 PDT
Opt-Crash trace:


==4608== Invalid read of size 4
==4608==    at 0x82761D7: js::gc::MarkIonCodeRoot(JSTracer*, js::ion::IonCode**, char const*) (Heap.h:1011)
==4608==    by 0x832D8F0: js::ion::IonCompartment::mark(JSTracer*, JSCompartment*) (Ion.cpp:170)
==4608==    by 0x808EE74: JSCompartment::mark(JSTracer*) (jscompartment.cpp:460)
==4608==    by 0x80C5BA0: _ZN2jsL11MarkRuntimeEP8JSTracerb.clone.0 (jsgc.cpp:2612)
==4608==    by 0x80C6A2A: BeginMarkPhase(JSRuntime*) (jsgc.cpp:3322)
==4608==    by 0x80C7319: IncrementalCollectSlice(JSRuntime*, long long, js::gcreason::Reason, js::JSGCInvocationKind) (jsgc.cpp:3975)
==4608==    by 0x80C9E1B: GCCycle(JSRuntime*, bool, long long, js::JSGCInvocationKind, js::gcreason::Reason) (jsgc.cpp:4186)
==4608==    by 0x80CA369: Collect(JSRuntime*, bool, long long, js::JSGCInvocationKind, js::gcreason::Reason) (jsgc.cpp:4300)
==4608==    by 0x80CA5F5: js::gc::RunDebugGC(JSContext*) (jsgc.cpp:4597)
==4608==    by 0x8179680: js_NewGCString(JSContext*) (jsgcinlines.h:446)
==4608==    by 0x81796BD: js_NewString(JSContext*, unsigned short*, unsigned int) (String-inl.h:206)
==4608==    by 0x827DD4A: js::StringBuffer::finishString() (StringBuffer.cpp:63)
==4608==  Address 0x0 is not stack'd, malloc'd or (recently) free'd



S-s due to GC-related crash.
Comment 2 Christian Holler (:decoder) 2012-08-13 17:19:02 PDT
JSBugMon: The testcase found in this bug no longer reproduces (tried revision a8235a2a29c2).
Comment 3 David Anderson [:dvander] 2012-08-13 17:41:50 PDT
A null crash or memory leak at worst.
Comment 4 David Anderson [:dvander] 2012-08-13 17:44:18 PDT
Created attachment 651589 [details] [diff] [review]
fix

The marking of EnterJIT is based on whether or not we can prove it's on the callstack. Previously, that meant if any Ion code was running at all. After the JM->Ion inlining patch, we have to be a little more strict: EnterJIT is only on the call stack if the activation came from EnterIon.
Comment 5 David Anderson [:dvander] 2012-08-14 12:32:56 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/a1435f952ff1
Comment 6 Christian Holler (:decoder) 2013-02-07 05:17:35 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.