Closed Bug 803019 Opened 8 years ago Closed 8 years ago

"Assertion failure: grayRoots.empty()" with schedulegc and gczeal

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla20

People

(Reporter: jruderman, Assigned: billm)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase
1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi
2. Load the testcase

Assertion failure: grayRoots.empty(), at js/src/jsgc.cpp:2030
Attached file stack
Assignee: general → wmccloskey
Attached patch patchSplinter Review
The problem here is that we are only asked to collect the atoms compartment. However, we can only collect the atoms compartment if we're collecting everything else. So effectively we're not collecting any compartments.

I considered fixing the testing code so that we aren't allowed to schedule a GC on only the atoms compartment. However, it's sort of awkward to do that. Also, I think it might make sense to handle this case correctly anyway. So the patch just aborts the GC if no compartments need to be collected.

While checking that this is an okay thing to do, I noticed that the JSGC_END callback does ClearGCBeforeCC unconditionally. However, that flag is basically saying that some of the gray mark bits are in an undefined state. We should only clear it if the GC has successfully reset the gray bits for all compartments. And that only happens in a full GC. So I fixed that.
Attachment #686878 - Flags: review?(jcoppeard)
Comment on attachment 686878 [details] [diff] [review]
patch

Review of attachment 686878 [details] [diff] [review]:
-----------------------------------------------------------------

Yes that looks good.
Attachment #686878 - Flags: review?(jcoppeard) → review+
https://hg.mozilla.org/mozilla-central/rev/d8c788ff2545
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.