842326 - BaselineCompiler: Assertion failure: [barrier verifier] Unmarked edge: baseline-stub-ioncode, at gc/Verifier.cpp:578

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on baseline compiler branch revision 1c8552cc6ec4 (run with ):


function TestCase(n, d, e, a)
  this.passed = getTestCaseResult(e, a);
function getTestCaseResult(expected, actual) {
  if (actual != actual)
    return gTestcases;
}
gczeal(4);
var TEST_STRING = new String("");
new TestCase(null, 0,eval("x = new Boolean(true); x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(0)") );
new TestCase(null, null, 0, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(1)"));
new TestCase(null, null, 0, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(2)"));
new TestCase(null, null, 0, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(3)"));
new TestCase(null, null, Number.NaN, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(4)"));
new new let (r) (function () {}) ();

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

When we unlink stubs, we have to trace them if incremental gc is active.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/a3e644aa7434