808140 - "Assertion failure: needsBarrier_,"

Status: RESOLVED DUPLICATE of bug 808067

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

gc();
this;
function f(sandboxType) {
    switch (sandboxType) {
        default:
            primarySandbox = newGlobal('')
    }
    return function(code) {
        try {
            evalcx(code, primarySandbox)
        } catch (e) {}
    }
}
function g(code) {
    h(code)
}
h = f()
gcPreserveCode()
g("\
    var y,x,z;\
    Object.defineProperty(this,\"m0\",{\
        get:function(){x=i0}\
    });\
    i0 = Iterator(2,z);\
    m0();\
");
g("\
    gcslice(1);\
    gc();\
    m0;\
")

asserts js debug shell on m-c changeset 556b9cfb269f with --ion-eager at Assertion failure: needsBarrier_, 

s-s because this involves gc, assuming sec-critical unless otherwise shown. JSBugMon, I'm counting on you.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This looks like bug 808067. /me bugmail check Fail.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   112050:23eb7d58bf90
user:        Bill McCloskey
date:        Thu Nov 01 08:08:21 2012 -0700
summary:     Bug 807535 - Avoid toggling Ion write barrier too often (r=sstangl)

This iteration took 5.038 seconds to run.