Last Comment Bug 782083 - IonMonkey: Assertion failure: thing, at gc/Marking.cpp:87 or Opt-Crash [@ js::gc::MarkIonCodeRoot]
: IonMonkey: Assertion failure: thing, at gc/Marking.cpp:87 or Opt-Crash [@ js:...
[ion:p1:fx18] [jsbugmon:update,ignore]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Linux
-- major (vote)
: ---
Assigned To: David Anderson [:dvander]
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-08-11 17:05 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:17 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (1.43 KB, patch)
2012-08-13 17:44 PDT, David Anderson [:dvander]
jdemooij: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-08-11 17:05:28 PDT
The following testcase asserts on ionmonkey revision f1764bf06b29 (run with --ion -n -m --ion-eager):

function r() {}
function randomFloat () {\
    if (r < 0.25)\
        fac = 10000000;\
for (var i = 0; i < 100000; i++)\
Comment 1 User image Christian Holler (:decoder) 2012-08-11 17:06:02 PDT
Opt-Crash trace:

==4608== Invalid read of size 4
==4608==    at 0x82761D7: js::gc::MarkIonCodeRoot(JSTracer*, js::ion::IonCode**, char const*) (Heap.h:1011)
==4608==    by 0x832D8F0: js::ion::IonCompartment::mark(JSTracer*, JSCompartment*) (Ion.cpp:170)
==4608==    by 0x808EE74: JSCompartment::mark(JSTracer*) (jscompartment.cpp:460)
==4608==    by 0x80C5BA0: _ZN2jsL11MarkRuntimeEP8JSTracerb.clone.0 (jsgc.cpp:2612)
==4608==    by 0x80C6A2A: BeginMarkPhase(JSRuntime*) (jsgc.cpp:3322)
==4608==    by 0x80C7319: IncrementalCollectSlice(JSRuntime*, long long, js::gcreason::Reason, js::JSGCInvocationKind) (jsgc.cpp:3975)
==4608==    by 0x80C9E1B: GCCycle(JSRuntime*, bool, long long, js::JSGCInvocationKind, js::gcreason::Reason) (jsgc.cpp:4186)
==4608==    by 0x80CA369: Collect(JSRuntime*, bool, long long, js::JSGCInvocationKind, js::gcreason::Reason) (jsgc.cpp:4300)
==4608==    by 0x80CA5F5: js::gc::RunDebugGC(JSContext*) (jsgc.cpp:4597)
==4608==    by 0x8179680: js_NewGCString(JSContext*) (jsgcinlines.h:446)
==4608==    by 0x81796BD: js_NewString(JSContext*, unsigned short*, unsigned int) (String-inl.h:206)
==4608==    by 0x827DD4A: js::StringBuffer::finishString() (StringBuffer.cpp:63)
==4608==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

S-s due to GC-related crash.
Comment 2 User image Christian Holler (:decoder) 2012-08-13 17:19:02 PDT
JSBugMon: The testcase found in this bug no longer reproduces (tried revision a8235a2a29c2).
Comment 3 User image David Anderson [:dvander] 2012-08-13 17:41:50 PDT
A null crash or memory leak at worst.
Comment 4 User image David Anderson [:dvander] 2012-08-13 17:44:18 PDT
Created attachment 651589 [details] [diff] [review]

The marking of EnterJIT is based on whether or not we can prove it's on the callstack. Previously, that meant if any Ion code was running at all. After the JM->Ion inlining patch, we have to be a little more strict: EnterJIT is only on the call stack if the activation came from EnterIon.
Comment 5 User image David Anderson [:dvander] 2012-08-14 12:32:56 PDT
Comment 6 User image Christian Holler (:decoder) 2013-02-07 05:17:35 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.