830719 - IonMonkey: Assertion failure: !InNoGCScope(), at ../../gc/Root.h:886

Status: RESOLVED DUPLICATE of bug 772820

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision b72d2af170aa (run with --ion-eager):


evaluate("\
a = function() {};\
function assertArraysEqual(a, b) {\
        assertEq(a[i], b[i]);\
}\
function check(b) {\
    var a = deserialize(serialize(b));\
    assertArraysEqual(a, b);\
}\
var ctors = [\
    Int8Array,\
    Uint8Array,\
    Int16Array,\
    Uint16Array,\
    Int32Array,\
    Uint32Array,\
    Float32Array,\
    Float64Array,\
    Uint8ClampedArray];\
for (var i = 0; i < ctors.length; i++) {\
    var ctor = ctors[i];\
    b = ctor(0);\
    check(b);\
    b = ctor(100);\
    check(b);\
}\
");
evaluate("assertArraysEqual(a[1], Int8Array([1, 2, 3]));");

Comment 1

[Christian Holler (:decoder)]

S-s due to GC-relatedness.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   115711:9602f98a6a70
user:        Terrence Cole
date:        Wed Dec 05 14:21:44 2012 -0800
summary:     Bug 819118 - Use accessor rather than direct script access; r=billm

This iteration took 112.987 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo regarding comment 2 :)

Comment 4

[Terrence Cole [:terrence]]

Good find. Not sec-crit because we're not moving yet. I'll add it to our fuzz list too.

Comment 5

[Terrence Cole [:terrence]]

Attachment: v0

It looks like we just need to pass a Handle through here.

Comment 6

[Brian Hackett [Laid off!]]

Comment on attachment 703100 [details] [diff] [review]
v0

Review of attachment 703100 [details] [diff] [review]:
-----------------------------------------------------------------

Well, going forward we shouldn't have any GC activity under the oracle functions, and I'd rather not add more roots that may need to be removed later.  I filed bug 772820 a while back to fix this issue, just posted a patch there.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 02e12a80aef9).

Comment 8

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   119272:7b531a62b114
user:        Brian Hackett
date:        Fri Jan 18 09:23:28 2013 -0700
summary:     Bug 772820 - Disallow GCs during script analysis or compilation, r=billm.

This iteration took 82.560 seconds to run.

Comment 9

[Brian Hackett [Laid off!]]

Fixed by bug 772820 per comments 6 and 8.